NEW YORK — The Qubic network halted on Sunday after an attacker reportedly exploited weakly generated wallet seeds to empty 1,404 wallets. Qubic’s own count, posted to X at 12:29 UTC on 18 October, puts the haul at about 2.94 trillion QU, drained between 23:42 UTC on 17 October and 01:26 UTC on 18 October.
A seed works as a wallet’s master password, so a guessable one is a door left unlocked. Qubic said, according to Cointelegraph, that the flaw touched seeds created in any browser on an iPhone or iPad, in Safari on a Mac until 18 October, or in the Qubic iOS app before July 2025. It is the same class of failure as the Coldcard hardware wallet hack TEH reported this summer, where predictable seed phrases let attackers rebuild keys.
The scale is what turns this from a heist into a design question. By TEH’s arithmetic, Qubic’s window is 104 minutes, or roughly 13.5 wallets a minute, and the haul averages about 2.1 billion QU a wallet. Cointelegraph’s report values the loss at about $1.4 million, which works out to roughly $1,000 a wallet, a pattern that points to many small balances swept at speed, though an average hides the spread.
Most of the stolen money, by Qubic’s account, never left the network. Qubic said 87.1% of the drained funds “never left the Qubic network and remain frozen in place,” while the remaining 12.9% “was sent to MEXC, whose team froze the receiving account within about an hour,” Cointelegraph reported. Applied to the 2.94 trillion total, TEH’s arithmetic gives roughly 2.56 trillion QU frozen on the network and about 379 billion at the exchange.
The fix is plain. Cointelegraph said a GitHub commit for web wallet version 4.26.4 replaced JavaScript’s Math.random(), which it described as unsuitable for generating cryptographic secrets, with crypto.getRandomValues(). Cointelegraph also tied the theft to a run of weak-seed attacks that includes Coldcard in July and, in 2023, Trust Wallet’s browser extension and the Libbitcoin Explorer tool. Software wallets have failed other ways too: TEH reported how a SecondFi Cardano exploit let attackers reconstruct private keys from public data.
Who decides what happens to the frozen funds is the open part. Qubic said its core team is identifying affected wallets and preparing recovery options for a vote by the network’s Computors, and, Cointelegraph noted, it has not said when the chain will restart. TEH could read only the opening lines of Qubic’s post, so the wallet count and token totals are Qubic’s figures, not independently checked. Cointelegraph’s report does not say who the attacker is, or how they found the seeds.
