The direct market fallout is contained: QUBIC is a small-cap token, the loss is modest in dollar terms, and the selling has so far stayed confined to the token itself rather than spreading to the wider crypto market. The bigger near-term pressure is liquidity, with the network halted and exchanges suspending deposits and withdrawals, leaving holders unable to move tokens until the chain restarts. How the Computor vote handles restitution is likely to matter more for the token’s recovery than the theft itself, since a clean, transparent outcome could steady confidence while a drawn-out freeze would add to doubts. The episode may also renew scrutiny of other wallet providers’ key-generation practices.
—
Qubic’s blockchain held up but its wallet keys did not, and while freezing the network saved most of the stolen tokens, it also shows how much power a small validator group holds over users’ funds.
Summary:
An attacker drained 1,404 Qubic wallets of around 2.94 trillion QU, roughly $1.3 million, in under two hours on October 17-18 UTC
The flaw was weak randomness in wallet seed generation, not the Qubic protocol, and is fixed in version 4.26.4
Wallets created via browsers on iPhone and iPad, Safari on Mac, and older iOS app versions were exposed
The network halted at tick 85,371,949, with around 87% of stolen funds frozen on-chain and the rest frozen at MEXC
Exchanges suspended QUBIC deposits and withdrawals, and the token fell more than 10%
Qubic’s Computor validators will decide on recovery and any restitution
Layer 1 blockchain Qubic has halted its network after an attacker exploited weak randomness in wallet seed generation to drain 1,404 wallets of around 2.94 trillion QU tokens, worth roughly $1.3 million, over a window of less than two hours late on October 17 and early October 18 UTC, according to a post from the project.
Qubic stressed that the flaw sat in the tool used to create wallet seeds rather than in the blockchain protocol itself. The affected code relied on a random number function that is not designed for cryptographic secrets, which meant seeds that looked long and secure were in practice predictable enough for an attacker to reconstruct a smaller pool of likely candidates and scan them for funded wallets. Wallets created through browsers on iPhone and iPad, through Safari on Mac until October 18, and through older versions of the Qubic iOS app were exposed. The project says the issue is fixed in version 4.26.4.
Validators stopped the network at tick 85,371,949. Around 87% of the stolen tokens remain on Qubic and are frozen by the halt, while the remaining 13% or so was sent to the MEXC exchange, which froze the receiving account. Other exchanges have suspended QUBIC deposits and withdrawals. The token fell more than 10% after the attack, and the project carries a market value of only around $60 million, which keeps the incident small in dollar terms.
—
Key terms explained
Wallet seed
A string of characters, often shown as a list of words, that generates and restores a crypto wallet’s private keys. Anyone who has the seed controls the funds, so it must be impossible to guess.
Randomness in seed generation
Seeds need to come from a truly unpredictable source. Some ordinary programming functions only look random and follow patterns, which can let an attacker narrow down the possible seeds and find funded wallets. That’s what happened at Qubic.
Layer 1 blockchain
A base blockchain network with its own rules and token, such as Bitcoin or Ethereum, as opposed to an app or network built on top of another chain.
Computors
Qubic’s equivalent of validators: a fixed group of operators who process transactions and vote on network decisions, including whether to halt the chain and what happens to frozen funds.
Tick
Qubic’s unit of network time, similar to a block number on other chains. Halting at a specific tick marks the exact point after which no transactions were processed.
—
The episode offers two lessons for crypto users. The first is that a secure blockchain does not guarantee secure funds: control rests on private keys, and keys are only as strong as the software that generates them. Similar weak-randomness flaws have hit other wallet tools in recent years. The second is that a network able to pause itself and freeze balances is making a trade-off. The halt protected most of the stolen funds, but it also shows that a relatively small group of validators, known on Qubic as Computors, can stop transactions and decide what happens to user assets.
That group now holds the key decision. Readers should watch when and how the network restarts, whether the Computor vote delivers restitution for victims, whether MEXC returns the frozen portion, and what the promised technical report reveals. A clean recovery would support confidence in Qubic’s governance, while a prolonged halt or a contested vote would raise harder questions about how decentralised the network really is.
This article was written by Eamonn Sheridan at investinglive.com.
