Operations on the Qubic blockchain came to an abrupt halt at tick 85,371,949. Developers of the Layer-1 network decided to shut down the chain between October 18 and 19, 2026, after a hacker compromised more than 1,400 wallets and drained 2.94 trillion Qubit (QU) tokens, worth approximately $1.4 million.
The drastic move was taken for good reason: freezing the network immediately locked most of the stolen funds in place.
How Basic Random Code Unlocked 1,400 Wallets
The intruder did not target smart contract vulnerabilities or breach central servers. Instead, the entry point lay in the seed phrase generation mechanism of the official Qubic wallet. Rather than using a cryptographically secure random standard, legacy versions of the web wallet relied on JavaScript’s built-in Math.random() function to generate users’ secret recovery phrases.
The mathematical function produces pseudo-random output whose patterns can be predicted once an attacker analyzes the underlying algorithm. The vulnerability’s impact extended widely across the Apple ecosystem: vulnerable accounts included users of any browser on iPhone and iPad, Safari users on Mac up until October 18, 2026, and users of the Qubic iOS app versions released prior to July 2025.
Developers promptly updated the web wallet generator to version 4.26.4 on GitHub. In the patch commit, the team replaced Math.random() with crypto.getRandomValues() to ensure the seed generation process has proper cryptographic security.
Similar incidents have occurred repeatedly across the crypto industry. In July, hardware wallet maker Coldcard disclosed a theft resulting from seeds weakened by a firmware bug. Similar vulnerabilities also affected the Trust Wallet browser extension and the Libbitcoin Explorer tool in 2023.
Most Stolen Funds Remain Trapped On-Chain
Although trillions of QU tokens changed hands, the perpetrator was unable to freely move the loot. A total of 87.1% of the stolen coins never left the Qubic network. Those balances froze instantly when validators halted block production, cutting off the hacker’s ability to transfer tokens to external exchanges.
The remaining 12.9% was transferred by the attacker to the crypto exchange MEXC. Swift action from exchange operators quickly curtailed the hacker’s movements: MEXC froze the recipient account within about an hour of the incoming transaction.
Fate of the Funds in the Hands of Computors
Qubic operates as a Layer-1 blockchain providing feeless transactions and smart contracts. Its architecture relies on Useful Proof of Work (UPoW), a consensus mechanism that directs mining computational power toward training artificial intelligence (AI) models. According to CoinGecko data at the time of writing, the QU token had a market capitalization of around $62.6 million.
The recovery path of the ecosystem now rests in the hands of Computors, the name given to validators on the Qubic network. The core team is compiling a list of affected wallets and drafting several recovery proposals to be voted on by Computors.
As of now, developers have not announced when the network will resume normal operations. A full post-mortem technical report will only be released once the recovery plan is approved. For QU holders, clarity regarding their balances will only come once the Computors finish voting.
Reported by Cointelegraph.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
