Qubic says wallet seeds created on certain Apple devices lacked sufficient randomness. The team has fixed the software; the network’s Computor participants will decide how to recover the funds.
Qubic has halted transaction processing after an attacker drained about 2.94 trillion QU from 1,404 wallets. According to the project’s October 18 incident update, the theft took place between 23:42 UTC on October 17 and 01:26 UTC on October 18, a window of one hour and 44 minutes.
The network’s Computors, which validate transactions, coordinated a protective halt at tick 85,371,949. Qubic said 87.1% of the drained funds had never left the network and could not be moved while transaction processing remained suspended.
In its account of where the funds went, the team said the remaining 12.9% had been sent to MEXC, which froze the receiving account within about an hour. Qubic also said exchanges had been notified and had suspended QUBIC deposits and withdrawals.
Which wallets are affected?
Qubic says the weakness was in seed generation, rather than the protocol. A seed is secret data that controls a wallet; Qubic’s wallet documentation describes its format as a string of 55 lowercase letters. The team said some seeds had been generated with insufficient randomness, allowing the attacker to exploit them. It identified the following affected environments for Qubic wallets:
| Device or application | When the seed was created |
|---|---|
| Any browser on an iPhone or iPad | Before October 18, 2026 |
| Safari on a Mac | Before October 18, 2026 |
| Qubic iOS app | Before July 2025 |
The team said version 4.26.4 corrects seed generation and prevents new weak seeds from being created. Its announcement does not say that updating the software automatically secures seeds generated earlier.
Network participants will decide on recovery
The Core team said it was identifying every affected wallet identity and preparing possible solutions. Under the announced process, the Computor quorum will decide on a resolution under the network’s rules. A Discord community poll was opened to inform Computors of users’ views; the announcement did not give it binding decision-making authority.
No recovery timetable has been announced. Qubic has yet to specify how frozen funds would be returned to users or when the network would restart.
Qubic asked affected users to file reports with police or cybercrime authorities in their country, including their wallet ID, the amount lost and a transaction link from the block explorer. It said formal reports help exchanges keep funds frozen. A full technical report is planned once recovery has been settled.
Warning against fake support messages, the team said it would not message users first, ask for their seed or offer paid recovery services. The secret seed that controls a wallet is separate from the public wallet identity requested for a report.
