Qubic Blockchain Halts Operations After Seed Generation Flaw Drains 1,400+ Wallets

Critical Seed Generation Vulnerability Discovered

The Qubic blockchain network ceased operations this past Sunday following discovery of a critical vulnerability in its wallet seed generation process that resulted in the compromise of over 1,400 accounts. According to Qubic, the breach involved the theft of approximately $1.4 million in value, represented as 2.94 trillion Qubic tokens (QU). The network remains halted at tick 85,371,949 as the project’s leadership works to devise a recovery strategy.

The Vulnerability and Its Impact

The security flaw affected multiple platforms where wallet seeds were being generated, including web browsers on iPhones and iPads, Safari on Mac computers until October 18, and the Qubic iOS mobile application prior to July 2025. The core issue stemmed from improper cryptographic implementation: wallet seeds were being generated using JavaScript’s Math.random() function, which is unsuitable for cryptographic purposes. This weak randomization allowed an attacker to predict seed values and gain unauthorized access to the affected wallets.

Qubic confirmed that the majority of the stolen assets never left its network. Specifically, 87.1% of the drained funds remain frozen on-chain, while the remaining 12.9% transferred to the MEXC cryptocurrency exchange was quickly immobilized by the exchange’s team within approximately one hour of detection.

Technical Fix and Recovery Efforts

The Qubic development team has already implemented a fix in version 4.26.4 of its web wallet, replacing the vulnerable Math.random() function with crypto.getRandomValues(), which provides cryptographically secure random number generation. The team is working to identify all affected wallets and preparing recovery options that will be put to a vote by the network’s validator set, known as Computors. A comprehensive technical analysis is expected to be released once the recovery plan is finalized, though the project has not yet announced a timeline for network operations to resume.

This incident follows a troubling pattern of wallet seed vulnerabilities across the cryptocurrency ecosystem, with similar weaknesses previously discovered in Coldcard hardware wallets, Trust Wallet’s browser extension, and the Libbitcoin Explorer tool. According to AMLBot’s analysis of 250 investigations conducted in 2026, hacks and exploits accounted for 19% of reported crypto crime cases but represented 40% of total losses. Qubic operates as a layer-1 blockchain offering transaction and smart contract functionality without fees, powered by a Useful Proof of Work consensus mechanism that directs mining energy toward artificial intelligence training. At the time of the incident, Qubic’s token held a market capitalization near $62.6 million. This episode underscores how critical secure wallet implementations are for protecting user assets and maintaining blockchain network stability.

Source: Qubic, via Cointelegraph. Not financial advice.