Qubic validators halted the network after an overnight theft drained 1,404 wallets of about 2.94 trillion QU, estimated at $1.3 million. According to project developers, the incident did not stem from a flaw in the blockchain itself but from predictable wallet seeds generated in some older software and device environments.
The transfers took place between 23:42 UTC on Saturday and 01:26 UTC on Sunday, before Computors, Qubic’s validators, stopped transactions at tick 85,371,949. Most of the stolen tokens remain frozen because of the network pause, while another portion was reportedly sent to MEXC and frozen there.
Attack traced to low-entropy seed generation
Developers said the breach was tied to insufficient randomness in the creation of 55-character wallet seeds. Instead of brute-forcing an enormous range of possible combinations, the attacker was apparently able to rebuild a narrower set of predictable seeds and then locate wallets that held funds.
The affected wallets were linked to seeds created on iPhones and iPads through browsers, on Macs using Safari, and in older versions of Qubic’s iOS application. Qubic said the issue was fixed in version 4.26.4.
Scope of losses and emergency response
The theft emptied 1,404 wallets and removed approximately 2.94 trillion QU before the network was halted. Qubic developers also said they secured additional vulnerable funds before the attacker could reach them.
At around 10 a.m. Eastern time on Sunday, Qubic’s native token was down more than 10%, according to the source report. The incident left the project dealing with both the theft itself and the operational fallout from pausing the chain.
Most stolen QU is currently immobilized
Roughly 87.1% of the stolen QU remained on the Qubic network and was immobilized once validators suspended activity. The remaining 12.9% reportedly reached the cryptocurrency exchange MEXC, which froze the receiving account.
The report added that QEARN stakes were unaffected. Bitget later suspended QUBIC deposits and withdrawals for maintenance following the incident.
Restitution now depends on validator decisions
With the network paused and much of the stolen balance unable to move, the next major question is whether affected users will be made whole. The report said that any restitution decision now rests with Qubic’s Computor quorum.
The episode also revives scrutiny of the project’s security practices. Qubic was founded by Sergey Ivancheglo, known as Come-from-Beyond, an early blockchain developer associated with NXT and IOTA. In 2025, the project drew controversy after claiming majority control of Monero’s mining hashrate and following blockchain reorganizations that unsettled members of the Monero community.
For now, the confirmed next steps are limited: the vulnerable seed-generation issue has reportedly been patched in version 4.26.4, exchange activity has been restricted in some cases, and victims are waiting to see what action Qubic’s validators take regarding frozen funds and possible restitution.
Source: news.bitcoin.com