# Qubic halts its blockchain after weak wallet seeds let an attacker drain 1,404 accounts of about $1.4 million

Qubic generated wallet seeds with JavaScript's Math.random function on Apple browsers, and about 87% of the stolen QU is now frozen by the chain halt while MEXC froze the rest.

- Published: 2026-10-19T05:41:35.249Z
- Canonical: https://polylog.news/crypto/2026-10-19/qubic-halts-its-blockchain-after-weak-wallet-seeds-let-an-at
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [crypto.news](https://crypto.news/qubic-hack-leaves-1-4-million-in-stolen-tokens-frozen/), [Cointelegraph](https://cointelegraph.com/news/qubic-freezes-chain-after-attacker-drains-14k-wallets-with-weak-seeds), [The Crypto Times](https://www.cryptotimes.io/2026/10/19/qubic-halts-network-after-1-3m-drain-hits-1404-wallets-through-weak-seeds/), [Crypto Briefing](https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/)

Qubic, a layer-1 blockchain that markets itself as a decentralized AI computing network, stopped producing blocks after an attacker [stole about 2.94 trillion QU tokens, worth roughly $1.4 million, from more than 1,400 accounts](https://crypto.news/qubic-hack-leaves-1-4-million-in-stolen-tokens-frozen/), according to an Oct. 18 statement from its core team. Other outlets put the value [nearer $1.3 million](https://www.cryptotimes.io/2026/10/19/qubic-halts-network-after-1-3m-drain-hits-1404-wallets-through-weak-seeds/).

The root cause was weak randomness during key generation. Qubic wallets created in any browser on an iPhone or iPad, in Safari on a Mac until Oct. 18, or in the Qubic iOS app before July 2025, built their seeds with JavaScript's Math.random function. That function is [not designed to generate cryptographic secrets](https://cointelegraph.com/news/qubic-freezes-chain-after-attacker-drains-14k-wallets-with-weak-seeds). Seeds built this way are predictable enough that an attacker can search for them and find many. Qubic has now switched to the browser's secure generator, crypto.getRandomValues. The attack ran from 23:42 UTC on Oct. 17 to 01:26 UTC on Oct. 18, about one hour and 44 minutes, and emptied [1,404 wallets](https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/).

The response shows how much control sits with a small group. The team halted the network at tick 85,371,949, and it remains paused. About 87% of the stolen tokens are still on Qubic and are frozen by the halt. The attacker sent the remaining 13% or so to the MEXC exchange, which froze the receiving account. The core team is identifying affected wallets and preparing recovery options for a vote by Computors, the validator set that runs the network. They will decide what happens to the frozen funds. No attribution has been announced.

The incident fits a pattern seen in hardware wallets this year. The on-chain contracts worked as written, and the loss came from how keys were made. A chain that can stop and then vote to redirect balances offers its users a refund path. It also shows that a small operator group can override the ledger whenever it chooses.

## What this means

Users who created wallets on Apple devices are the direct losers. QU holders in general are exposed to a governance precedent: Computors can now stop the chain and reassign balances, and that power will apply to future disputes too. Victims want restitution, the attacker wants the 13% that reached MEXC, and the Computors want the chain running again without a lasting split. The likeliest outcome within weeks is a Computor vote to return the frozen 87% to affected wallets and a restart, with the MEXC portion settled through the exchange. That read depends on the operators agreeing among themselves. A contested vote that splits the validator set, or a restart without restitution, would prove it wrong. The broader lesson is the 2008 Debian OpenSSL entropy bug: weak key generation goes unnoticed for years and then breaks all at once, and other wallets that generate seeds in browser JavaScript carry the same class of risk.

## What to watch

- The Computor vote on recovery. Returning frozen funds would confirm that a small operator group can change balances on Qubic.
- Whether other browser-based wallets audit how they generate seeds after this disclosure. A second drain from the same flaw would turn one project's bug into a pattern across the industry.
- How long the chain stays halted. A long pause hurts exchange listings and the network's claim to be decentralized.