Key Takeaways:
The attacker stole 1,404 wallets and about 2.94 trillion QU from them.At tick 85,371,949 Qubic suspended the community to forestall any extra motion.87.1% of the {dollars} withdrawn are nonetheless on-chain, with MEXC holding the remaining 12.9% in its system.
Qubic has suspended its community after an attacker exploited weak pockets seeds and drained hundreds of accounts in a safety incident spanning October 17 – 18. The insufficiency of randomness was the problem of not the Qubic protocol itself, the mission mentioned.
Safety incident replace.
Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling round 2.94 trillion QU.
Here’s what occurred, what has been performed, and what comes subsequent. https://t.co/7aPJ26lEeZ
— Qubic (@_Qubic_) October 18, 2026
Qubic Freezes Community After 1,404 Wallets Are Drained
The assault was carried out between Oct. 17, 00:42 UTC and Oct. 18, 01:26 UTC and impacted about 1,404 wallets, eradicating roughly 2.94 trillion QU. Transaction processing was halted by Computors, which have established a protecting community halt at tick 85,371,949, the time at which the incident was mentioned to happen.
That motion has hindered the attacker’s skill to freely transfer the stolen wealth. Qubic mentioned that 87.1% of the deleted QU by no means went out of the online and are caught there. The rest (12.9%) went to crypto alternate MEXC, which froze the receiving pockets roughly one hour after receiving a name.
Notifying and suspending QUBIC deposits and withdrawals was additionally performed for different exchanges.
Qubic is tracing the incident again to the shortage of randomness in pockets seeds. The impacted app variations are: all generated seeds earlier than October 18, 2026, in Safari on Mac earlier than the identical date, and the Qubic iOS app as much as July 2025.
Learn Extra: Bitget Halts Withdrawals After $351.6M Scorching Pockets Incident Hits Crypto Trade
Model 4.26.4 Fixes the Seed Technology Concern
The issue has already been addressed for model 4.26.4, so no weak seeds might be shaped with it, mentioned the mission.
The Core crew has now began to search out all of the impacted wallets and is able to take the mandatory steps to get well them. The quorum of the Computor shall take the ultimate resolution on the frozen funds, in accordance with the governance guidelines of Qubic’s community.
They’re additionally holding a group ballot over Discord, to higher perceive the sentiment of Computors earlier than they put in a proposal for restoration.
Restoration Course of Strikes to the Computor Quorum
Regular transaction processing has not been introduced by Qubic but. Affected customers have been urged to police or cybercrime authorities and supply their pockets ID, quantity misplaced and related hyperlinks throughout the Qubic explorer of the transaction.
It might be useful to contain exchanges in sustaining freezes on related funds within the type of a proper report. Qubic additionally cautioned towards restoration scams saying its crew would by no means attain out to prospects initially to ask them for pockets seeds or present paid restoration providers.
As soon as the community involves a choice in regards to the restoration and frozen QU’s, a full technical report must be anticipated.
Learn Extra: Liquid Community Pauses After 4,000 BTC Value $320M Pulled in White-Hat Incident
