Qubic Halts Its Chain After 1,400+ Wallets Were Drained Through Weak Seeds — What to Check If You Created a Wallet

What happened, step by step

Qubic said in a statement on X that the network was stopped at tick 85,371,949 and remains halted. According to Qubic, an attacker exploited wallet seeds produced with a poor random-number source and swept the accounts those seeds controlled. The project's figures, as reported by Cointelegraph:

Qubic has not announced when the network will restart and says it will publish a full technical report after a recovery plan is settled. That means three things for holders today: nothing can be moved, the recovery plan is not yet decided, and anyone who contacts you offering to "recover" funds for a fee or for your seed phrase is a scammer. The official channels are the project's own X account and its network explorer.

What was actually wrong with the seeds

The cause is visible in the project's own code. Qubic's open-source web wallet on GitHub has a commit dated October 18, 2026 at 03:28 UTC titled "fix: use cryptographically secure seed generation", followed by release 4.26.4 about an hour later. The diff shows what changed: the old seed generator built a 55-letter seed from the alphabet a–z by calling JavaScript's Math.random() once per letter. The new generator calls crypto.getRandomValues(), the browser's cryptographic random source, and also discards byte values 234–255 so the letters come out evenly distributed rather than slightly biased.

Math.random() is designed for things like animations and shuffling a playlist. It is not designed to produce secrets, because its output can be predictable if the starting state can be guessed or narrowed down. A seed that looks like 55 random letters can therefore hold far less real randomness than its length suggests, and an attacker who can enumerate the likely seeds can derive the wallets without breaking any cryptography. Qubic says the weakness affected a specific set of environments (every browser on iPhone and iPad, Safari on Mac until October 18, and the old iOS app before July 2025); we can confirm from the code that the generator was replaced in the web wallet, but we cannot independently test which browsers produced guessable seeds, so we repeat the affected list as Qubic's statement.

Weak-seed incidents are not new. Cointelegraph's report notes that in July, attackers stole funds from wallets whose seeds had been weakened by a firmware bug, and that similar flaws hit the Trust Wallet browser extension and the Libbitcoin Explorer tool in 2023. AMLBot's third-quarter 2026 report, also cited there, found that hacks and exploits were 19% of the crypto-crime cases it investigated but 40% of the reported losses.

What to do now, depending on what you hold

If you created a Qubic wallet in an affected browser or app:

1. Assume the seed is compromised even if your balance still shows. The attack drained accounts in bulk; an account that has not been swept yet is not safe, it just has not been reached.
2. Do not try to move funds through unofficial tools or "rescue" sites. While the chain is halted nothing can settle, and fake recovery pages are the usual second wave after a hack.
3. Follow Qubic's official announcements on the recovery vote. When the network restarts, generate a new seed with the updated wallet (version 4.26.4 or later) or a hardware wallet, and move the balance to it before doing anything else.
4. Check any other wallet you made with the same tool on the same device, and any wallet where you reused the seed.

If you only hold other coins, run this five-minute check:

• Where did each of your seeds come from? A hardware wallet's secure chip, or a mainstream wallet app that generated it on your device, is a reasonable answer. A website's "generate seed" button, a browser script or a tool you downloaded years ago is not.
• Did you ever generate a seed in a mobile browser because it was convenient? If the answer is yes and the wallet holds more than pocket change, create a fresh wallet in a hardware wallet and move the funds across; it costs one network fee.
• Do not type a seed phrase into any site for any reason. Legitimate recovery never asks for it.
• Keep long-term holdings off the hot wallet you use for daily activity.

If you would rather not hold a seed at all for the part of your balance you trade, a major exchange account removes this particular risk. On OKX, invite code nexu888 carries a fee rebate through NexuAlpha, and the account-level protections that matter after a story like this are passkeys and the anti-phishing code; our walkthroughs cover setting up the OKX anti-phishing code and the withdrawal address allowlist. Exchanges have their own failure modes, so the sensible split is a hardware wallet for what you hold and an exchange for what you trade; the OKX profile lists fees and how the rebate settles.

Why the 12.9% that reached MEXC was frozen

Qubic says 12.9% of the stolen funds went to MEXC and that MEXC's team froze the receiving account within about an hour. That is the reason exchange compliance teams matter to ordinary holders: stolen coins that must pass through a regulated venue to become cash can often be stopped there, while coins that never leave the network stay frozen only as long as the network's own governance chooses. For Qubic that governance is a vote of its Computors, and the outcome is open. Qubic's token is a small asset by market cap, about $62.6 million at the time of reporting, so one incident of this size is a large share of the ecosystem.

What this means for the market

A $1.4 million theft is small next to the more than $1 billion of third-quarter security losses that Cointelegraph tallies for the industry, and the reaction will be local to the Qubic token. The reason it is worth reading about anyway is the mechanism. A weak-seed flaw does not require the attacker to break a blockchain, only to guess keys; once the method is known it can be pointed at any wallet tool with the same weakness. That is why the fix was a small code change and the damage was done before it landed.

Quick answers

What happened to Qubic? The network was halted on October 18, 2026 after an attacker drained about $1.4 million (2.94 trillion QU) from more than 1,400 accounts whose seeds were generated with a weak random-number source.

Which wallets are affected? According to Qubic: seeds generated in any browser on an iPhone or iPad, in Safari on a Mac until October 18, 2026, or in the Qubic iOS app before July 2025.

Is my money lost? Qubic says 87.1% of the stolen funds are frozen on the network and 12.9% was frozen at MEXC. Network validators (Computors) will vote on a recovery plan; there is no restart date yet.

What was the fix? Wallet version 4.26.4 replaced Math.random() with the browser's cryptographically secure crypto.getRandomValues() and removed letter bias, per Qubic's GitHub commit of October 18.

How do I check my own wallets? Ask where each seed was generated. Hardware wallets and mainstream wallet apps are fine; a website or script you cannot audit is not. If in doubt, make a new wallet and move the funds.

Is this a reason to avoid Qubic or other chains? The incident is about how seeds were generated in one set of wallet tools, not about the chain's consensus. It is a reason to know where your own seeds came from, whichever chain you use.