Qubic says an attacker drained 1,404 wallets and stole about 2.94 trillion QU during a security incident that took place between October 17 and 18. The project is disputing any suggestion that the losses came from a flaw in the layer-1 protocol itself, instead attributing the breach to weak wallet seed generation in certain environments.

In an update on the incident, the network said some wallet seeds had been created with insufficient randomness, making them easier to compromise. The team also said emergency steps taken by validators and exchanges have limited the movement of the stolen funds while the network determines how to proceed.

Where Qubic says the weakness came from

According to Qubic, the vulnerable seeds were generated on iPhones and iPads using any browser before October 18, on Macs using Safari before that date, or through the Qubic iOS app before July 2025. The network said these conditions could result in weaker-than-expected randomness during wallet creation.

Qubic maintains that this was a wallet seed generation issue rather than a defect in the protocol. The team said the problem has been addressed in version 4.26.4 and added that, under the corrected system, no new weak seeds can be created.

How the network responded

Qubic’s validators, known as Computors, coordinated a halt at tick 85,371,949 after the theft was identified. The pause was intended to stop any further movement of the stolen assets on-chain.

The project said 87.1% of the drained QU remains on the network and is currently frozen because transactions are paused. The remaining 12.9% was sent to MEXC, where, according to Qubic, the receiving account was frozen in roughly an hour. Qubic also said exchanges were notified and have suspended QUBIC deposits and withdrawals.

Decision now rests with the Computor quorum

Qubic said the next stage of the response depends on its Computor quorum, which will decide how the incident is handled under the network’s rules. The Core team is working to identify the affected identities and prepare options for that quorum to consider.

Alongside the internal review, the project has opened a community poll on Discord to gather feedback on the situation. No final resolution was described in the update.

What affected users have been told to do

The network has urged users who believe they were impacted to report the incident to local police or cybercrime authorities. Qubic said reports should include the wallet ID, the amount lost, and the transaction link from the Qubic explorer.

For now, the confirmed next steps are limited to the ongoing identification of affected accounts, the quorum’s eventual decision on how to resolve the incident, and the exchange-level restrictions that remain in place while the response continues.

Source: cryptopotato.com