The hack of 1,404 Qubic wallets was made possible by recovery phrases generated with insufficient randomization, not by a flaw in the blockchain itself. In less than two hours, the attacker stole approximately 2.94 billion QU. Validators then suspended transactions to block the funds still on the network, while the Qubic team identified the affected accounts and prepared proposals to submit to the quorum.
A flaw in wallet creation, not the protocol
Qubic attributed the incident to the generation of predictable wallet seeds. A seed, or recovery phrase, makes it possible to create and restore the keys that provide access to a wallet’s funds. If it is not generated with sufficient randomness, a third party may, under certain circumstances, guess or calculate the information needed to take control of the associated assets.
According to the project team, the problem lay in how certain seeds were created on specific devices and with specific software. Qubic therefore distinguished this vulnerability from a compromise of its protocol or consensus mechanism. In other words, the attack targeted wallets affected by a flawed generation method rather than the blockchain as a whole.
This distinction is important: a blockchain can continue to apply its rules correctly while recording transactions made with the keys of a compromised wallet. The ledger cannot, on its own, tell whether the person signing a transaction is the legitimate owner or a hacker who has obtained access to their seed. It checks that the transaction is valid under the network’s rules.
Potentially affected devices and seeds
Qubic reported that seeds generated before October 18, 2026 in a browser used on an iPhone or iPad could be vulnerable. The problem also affected seeds created with Safari on a Mac before that date. The team also identified seeds generated by the Qubic app on iOS before July 2025 as potentially affected.
This does not mean that every wallet created on these devices was necessarily emptied. Rather, these details define the circumstances in which a seed may have been generated with insufficient randomness. The impact therefore depended on the wallet in question and on whether the attacker could recover its recovery information.
Version 4.26.4 of the Qubic app fixes the creation process and, according to the project, prevents new vulnerable seeds from being generated. An update can reduce the risk for new wallets created with the patched software, but it does not automatically change the keys of an existing wallet. Affected holders should therefore follow the project’s official instructions for securing their funds and, if necessary, creating a wallet with a secure seed.
A theft carried out in less than two hours
According to the timeline published by Qubic, the malicious activity began on October 17 at 23:42 UTC and ended on October 18 at 1:26 UTC. During this period of less than two hours, the attacker took control of 1,404 wallets and transferred approximately 2.94 billion QU.
During the incident, the hacker was able to initiate transactions using the access credentials associated with the compromised wallets. The blockchain then processed these transactions as valid because they were signed with the corresponding keys. This is how a theft can occur without an attacker needing to modify the network’s code, control the validators, or rewrite the history of the blocks.
Qubic estimated the value of the stolen assets at approximately $1.29 million, based on the price cited in its report. This estimate varies with the token’s price and does not necessarily represent the amount that can actually be recovered. The ability to move, exchange, or freeze the funds also depends on where they are held and on the actions taken by the platforms involved.
Why the blockchain was not compromised
Exposed keys can be enough to authorize transfers
Cryptographic proof networks rely on private keys to authorize the movement of funds. The blockchain confirms that a signature corresponds to the wallet’s public key and that the transaction complies with the protocol’s rules. It generally cannot determine whether the key was used by its owner or obtained through fraudulent means.
In Qubic’s case, the explanation put forward by the project concerns the quality of seed generation. If seeds are predictable, an attacker may be able to derive the associated keys and sign transactions without exploiting a consensus vulnerability. The network then continues to operate as intended: it validates correct signatures, even if the person producing them is not the wallet’s legitimate holder.
This type of incident is different from an attack on the blockchain itself. A protocol compromise could, for example, involve changing the validation rules or taking control of the mechanisms that determine the order of transactions. Qubic, by contrast, said that the problem originated in the process used to create seeds for certain wallets.
Suspending the network to hold the funds
After the hack was detected, the Qubic Computors coordinated a suspension at block 85,371,949. This measure halted transactions on the network to limit subsequent movements and keep the stolen assets still present in the ecosystem from moving.
The pause does not mean that the funds were automatically returned to their owners. Rather, it is intended to prevent further transactions while the project assesses the situation. Any decision about what happens next depends on Qubic’s governance rules and a vote by the Computors quorum, according to the team’s statement.
This response also illustrates the difference between the technical operation of a blockchain and the governance measures that can be taken when an incident occurs. The suspension was coordinated by the participants responsible for operating the network; it is not, in itself, evidence that the underlying protocol had been hacked. However, it does affect users, since it blocks transfers during the suspension.
Most of the funds remain on the network
Qubic said that 87.1% of the stolen assets were still on the network at the time of its report. This represented the portion of the funds that the suspension could help immobilize. The situation was different for the remaining assets: approximately 12.9% had reached MEXC.
The exchange froze the recipient account in less than an hour, according to Qubic. Freezing a centralized account can prevent assets deposited on a platform from being withdrawn again, subject to the platform’s procedures. However, this alone cannot recover funds that remain on the blockchain or have been transferred elsewhere.
Several platforms also suspended QUBIC deposits and withdrawals. These restrictions can limit transfers between exchange accounts and the network while the incident is being investigated. They do not change the ownership recorded on the blockchain, but they temporarily reduce users’ ability to move their tokens through the services concerned.
The quorum’s role in Qubic’s response
Qubic’s core team set out to identify the affected wallets and prepare proposals for the quorum. The project said that resolving the matter should be a collective decision by the Computors and comply with the network’s rules.
Several steps remain: determining the extent of the losses, distinguishing wallets that were actually affected from those merely exposed to a vulnerable generation method, and reviewing options for handling the immobilized funds. The information shared by the project does not support the conclusion that a full recovery or compensation is already assured.
Affected holders therefore face two distinct questions: how to secure their future access and what decisions governance will make about the stolen assets. The seed-generation fix addresses the first issue for newly created wallets, while the quorum and the platforms involved play a role in handling the funds connected to the hack.
Market reaction after the incident
QUBIC’s price fell 5.2% in 24 hours, settling at around $0.0000004394, according to data reported by BeInCrypto Markets. Over the same period, the cryptocurrency market as a whole fell by 2.8%. The token’s decline was therefore steeper than that of the broader market, as investors reacted to reports of compromised wallets and the suspension of transactions.
A price decline does not directly measure the amount of losses or the technical scale of an attack. Among other things, it reflects uncertainty about how long the interruption will last, what decision the quorum will make, and whether the movement of funds can resume. Market figures are also subject to change and can shift rapidly after a security announcement.
The Qubic incident occurred on the same day as another event reported in the sector: Cysic’s cross-chain bridge was affected by the unauthorized creation of 10 million CYS tokens on BNB Smart Chain. These separate attacks fueled concerns about the security of crypto infrastructure in October, but they rely on different mechanisms and, on their own, do not support any shared conclusions about their causes.
