Qubic has halted its network after an attacker exploited insufficient entropy in seed phrase generation to drain 1,404 wallets of roughly 2.94 trillion QUBIC tokens, worth approximately $1.3 million, in under two hours. The theft occurred between 23:42 UTC on October 17 and 01:26 UTC on October 18, and represents about 2.05% of the token's 143.69 trillion circulating supply.
The Qubic team attributed the breach to seed phrases generated with insufficient entropy, a flaw that recalls the issue reported in Coldcard hardware wallets by Galaxy Research, where theft potentially reached 2,055 BTC, or roughly $166 million. The pattern underscores how weaknesses in randomness during key generation remain a recurring threat across different wallet ecosystems.
Qubic identified the affected seed phrases as those created on iPhone or iPad with any browser before October 18, 2026; on Mac using Safari before that date; and within Qubic's iOS app before July 2025. In response, Computors, the network participants who govern Qubic through quorum decisions, coordinated a protective halt of the network to limit further losses.
Most funds remain frozen
According to Qubic, 87% of the drained funds never left the network and remain frozen. The remaining 12.9% was sent to MEXC, whose team froze the receiving account within about an hour of the transfer. Exchanges that were notified of the incident have since suspended QUBIC deposits and withdrawals.
The token's price fell 10.74% over 24 hours to $0.0000004302, according to CoinMarketCap data, as news of the exploit spread. The decline adds pressure on a project that earlier in 2025 had attempted to dominate Monero's mining hashrate, drawing attention within the broader crypto mining community.
Patch and next steps
Qubic has released version 4.26.4 of its software, which corrects the seed generation process so that weak seeds can no longer be created. The Qubic Core team is now working to identify affected users and is preparing options for the Computors quorum to decide on a resolution. An open survey has been made available on Discord for community input, and Qubic has said a full technical report will follow once the recovery process is resolved.
Users affected by the theft are being advised to file a report with police or a cybercrime authority, including their wallet ID, the amount lost, and a transaction link from Qubic's explorer at explorer.qubic.org. Qubic has also reiterated a security warning that no representative of the project will contact users first, ask for seed phrases, or offer fund recovery in exchange for payment.
