Qubic’s layer-1 blockchain suspended all transaction processing after an attacker drained 1,404 user wallets of roughly 2.94 trillion QU tokens in under two hours. The project’s own incident update places the theft between 23:42 UTC on 17 October and 01:26 UTC on 18 October 2026.
At prevailing prices the stolen amount was valued near $1.3–1.4 million.
Validators known as Computors coordinated a protective halt at tick 85,371,949.
With the chain paused, no further transfers can be executed, locking most of the taken assets in place.
Official figures show that 87.1 percent of the drained QU never left the Qubic network and remain frozen on-chain.
Security incident update.
Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU.
Here is what happened, what has been done, and what comes next. pic.twitter.com/7aPJ26lEeZ
— Qubic (@_Qubic_) October 18, 2026
The remaining 12.9 percent reached the exchange MEXC, whose team froze the receiving account within about an hour of the deposit.
Other exchanges were notified and suspended QUBIC deposits and withdrawals.
The compromise did not involve the protocol, consensus, or smart-contract logic.
Certain wallet seeds had been generated with insufficient randomness, rendering them weaker than intended.
The attacker exploited that predictability to reconstruct the seeds and empty the associated wallets.
Affected seeds were those created on an iPhone or iPad in any browser before 18 October 2026, on a Mac using Safari before the same date, or in the Qubic iOS app before July 2025.
Seeds produced on other platforms or after the fix were not at risk.Seed generation was corrected in wallet version 4.26.4, replacing the insecure method with cryptographically secure randomness so that new weak seeds can no longer be created.
The core team is identifying every affected identity and preparing recovery options.
Any decision on restitution or the disposition of the frozen funds rests with the Computor quorum under the network’s existing rules.
A community poll is open on Discord to inform that vote.
A full technical report will be published once a recovery plan is settled; no restart timeline has been announced.
Users who believe they were affected are advised to file a formal report with local police or cybercrime authorities, including the wallet ID, amount lost, and transaction link from the Qubic explorer.
Such documentation assists exchanges in keeping related accounts frozen.
The project has also warned that it will never initiate private contact, request a seed phrase, or offer paid recovery services; any such messages should be reported as scams.
The episode highlights a recurring class of wallet-level failures: even a sound blockchain cannot protect funds when the seed that controls them was generated with inadequate entropy. Because the network can be paused by its Computors, the majority of the stolen tokens were contained before they could be fully liquidated.
