Layer-1 blockchain network Qubic halted operations on Sunday after an attacker exploited weakly generated wallet seeds to drain approximately $1.4 million from more than 1,400 accounts. The project confirmed the vulnerability affected wallet seeds generated using any browser on an iPhone or iPad, Safari on a Mac until October 18, 2026, or the Qubic iOS app before July 2025. This flaw resulted in the theft of 2.94 trillion Qubit (QU) tokens.
According to Qubic’s statement on X, the network was paused at tick 85,371,949. The team reported that 87.1% of the drained funds never left the Qubic network and remain frozen, while the remaining 12.9% was sent to the exchange MEXC, which froze the receiving account within about an hour. Qubic has since fixed the seed-generation flaw in its latest web wallet version by replacing JavaScript’s Math.random() function with the cryptographically secure crypto.getRandomValues().
The core team is currently identifying affected wallets and preparing recovery options for a vote by the network’s Computors, who will decide the fate of the frozen funds. A full technical report is expected once the recovery plan is settled, though no timeline for restarting the network has been announced. This incident follows similar security issues tied to weak wallet seeds in other projects, including Coldcard, Trust Wallet, and Libbitcoin Explorer.
The Qubic halt highlights the critical operational risks associated with non-standard cryptographic implementations in decentralized networks. By relying on Math.random(), a function unsuitable for generating secrets, the protocol introduced a systemic vulnerability that compromised user assets across multiple platforms. The immediate freeze of the chain demonstrates a centralized intervention capability within a layer-1 network, raising questions about decentralization versus security responsiveness during active exploits.
From a Compliance and Credibility perspective, the decision to let Computors vote on fund recovery introduces governance complexity. While freezing 87.1% of stolen funds mitigates total loss, the process relies on network consensus rather than automated smart contract logic, potentially delaying resolution. The incident underscores the necessity for rigorous third-party audits of foundational code, particularly random number generation, to maintain institutional trust and prevent recurring vulnerabilities in emerging blockchain infrastructures.
