Qubic halts its blockchain after weak wallet seeds let an attacker drain 1,404 accounts of about $1.4 million

Qubic, a layer-1 blockchain that markets itself as a decentralized AI computing network, stopped producing blocks after an attacker stole about 2.94 trillion QU tokens, worth roughly $1.4 million, from more than 1,400 accounts, according to an Oct. 18 statement from its core team. Other outlets put the value nearer $1.3 million.

The root cause was weak randomness during key generation. Qubic wallets created in any browser on an iPhone or iPad, in Safari on a Mac until Oct. 18, or in the Qubic iOS app before July 2025, built their seeds with JavaScript's Math.random function. That function is not designed to generate cryptographic secrets. Seeds built this way are predictable enough that an attacker can search for them and find many. Qubic has now switched to the browser's secure generator, crypto.getRandomValues. The attack ran from 23:42 UTC on Oct. 17 to 01:26 UTC on Oct. 18, about one hour and 44 minutes, and emptied 1,404 wallets.

The response shows how much control sits with a small group. The team halted the network at tick 85,371,949, and it remains paused. About 87% of the stolen tokens are still on Qubic and are frozen by the halt. The attacker sent the remaining 13% or so to the MEXC exchange, which froze the receiving account. The core team is identifying affected wallets and preparing recovery options for a vote by Computors, the validator set that runs the network. They will decide what happens to the frozen funds. No attribution has been announced.

The incident fits a pattern seen in hardware wallets this year. The on-chain contracts worked as written, and the loss came from how keys were made. A chain that can stop and then vote to redirect balances offers its users a refund path. It also shows that a small operator group can override the ledger whenever it chooses.