Switch to seedless. Get 30% off with SWITCH30 till Oct 19Qubic wallet exploit: $1.3M drained, most funds frozen
6.5 Security Qubic halted its network after a wallet flaw let an attacker drain $1.3M from 1,404 wallets. Most funds were frozen, and recovery depends on a validator vote. The protocol was not breached.
Qubic halted its network after an attacker exploited weak randomness in wallet seed generation, draining about 2.94 trillion QU tokens (roughly $1.3–$1.4 million) from 1,404 wallets within two hours on October 17–18, 2026. The vulnerability originated from using JavaScript’s Math.random() function for wallet creation on Apple devices and some browsers, making seed phrases predictable. Importantly, the Qubic protocol itself was not compromised. Validators managed to freeze 87.1% of the stolen funds on-chain, while the MEXC exchange blocked the remaining 12.9%. In response, exchanges suspended QUBIC deposits and withdrawals, and Qubic released a patch in version 4.26.4 to address the flaw. The recovery of stolen funds will depend on an upcoming validator vote. This incident highlights the critical importance of secure key-generation practices in crypto wallets. QUBIC’s price dropped 5.2% after the attack, though it remains unclear if the exploit directly caused the decline.
