How the Attacker Withdrew 2.94 Trillion QU in 104 Minutes
On the night of October 17-18, 2026, the Qubic network faced a massive cryptocurrency theft. According to a statement from the project's core team, from 23:42 on October 17 to 01:26 on October 18 UTC, the attacker withdrew 2,939,606,531,944 QU from 1,404 wallets. The market value of the stolen assets was estimated at approximately $1.3 million.
The peculiarity of the attack was that the attacker did not need to hack the blockchain's consensus mechanism. According to a preliminary explanation from the Qubic team, the cause was insufficient randomness in the creation of secret data for some crypto wallets.
Under normal conditions, cryptographic keys are generated from practically unpredictable data. If the random number generator uses an unreliable source of randomness, an attacker can significantly reduce the number of combinations needed to recover the secret key. As a result, they can gain control over the wallet, even though the blockchain continues to correctly verify transactions.
According to the list published by Qubic, the secret data of wallets created on the following platforms were potentially vulnerable:
On iPhone and iPad using any browser until October 18, 2026.
On Mac computers using the Safari browser until October 18, 2026.
In the Qubic app for iOS until July 2025.
According to the developers, the error in generating secret data was fixed in wallet version 4.26.4. However, the software update does not make previously created vulnerable keys secure. Users of such wallets need to replace the secret data according to the project's official recommendations.
The Qubic hack demonstrated the fundamental difference between blockchain security and crypto wallet security. Even if the transaction processing mechanism functions without errors, a wallet vulnerability can jeopardize users' funds.
Why Qubic Had to Stop the Entire Network
After detecting the attack, Qubic consensus participants agreed to an emergency halt of the blockchain at block 85,371,949. This decision restricted further movement of the stolen cryptocurrency but simultaneously deprived other users of the ability to conduct regular operations on the network.
According to a statement from the Qubic team on October 18, the stolen funds were distributed as follows:
Indicator | Volume | Status |
|---|---|---|
Total stolen | 2.94 trillion QU | About $1.3 million |
Remained in the Qubic network | 87.1% | Movement stopped |
Transferred to MEXC | 12.9% | Receiving account frozen |
A total of 1,404 wallets were affected by the attack. The MEXC exchange froze the account to which part of the stolen tokens was transferred. Another trading platform, Bitget, suspended QUBIC deposits and withdrawals to limit the risks of further asset movement.
However, freezing assets is not equivalent to returning them to their owners. The further procedure for handling the stolen tokens must be determined by Qubic participants within the network's established procedures.
This is where the contradiction arises. Protecting investors allowed for limiting the attacker's actions, but the consequences of the emergency measures extended far beyond the 1,404 affected wallets. Users not involved in the attack also temporarily lost the ability to manage their assets within the blockchain.
This does not mean that the halt was a mistake. Without intervention, the stolen tokens could have continued to move through other addresses and trading platforms. However, the effectiveness of such decisions must be assessed considering the consequences for other ecosystem participants.
Who Really Controls Qubic
The main question after the hack is not so much about the size of the losses, but about the network's governance structure. If blockchain participants can collectively suspend transaction processing, it is necessary to understand how independently they act and who determines the conditions for resuming operations.
Unlike Bitcoin, where transaction confirmation is ensured by a distributed network of miners, Qubic uses a computation consensus mechanism among a limited group of participants called calculators.
According to the official Qubic documentation, every week, at the beginning of a new epoch, the right to participate in the consensus is granted to 676 calculators selected according to protocol rules. Their position is determined by the results of associated miners who perform computational tasks.
To agree on a result, matching votes from at least 451 out of 676 calculators are needed, which is more than two-thirds of the group. This mechanism is called a quorum.
The distribution of powers includes another important role — the arbitrator. They publish the list of calculators after each epoch, set mining algorithm parameters, resolve disputes, and can exclude participants with insufficient performance. However, the arbitrator should not influence the execution of smart contracts and voting results.
The project's official documentation outlines a key principle:
“True decentralisation is a cornerstone of the Qubic platform.”
True decentralisation is a fundamental principle of the Qubic platform.
However, the network governance documentation acknowledges the potential issue of power concentration. If one party gains control over both the quorum and the arbitrator, a situation may arise where active calculators are more interested in maintaining their own position than in supporting independent competition.
Thus, the decentralisation of Qubic depends not only on the set number of calculators but also on how independently they make decisions. Network governance should ensure the separation of powers among participants, rather than merely formal compliance with numerical requirements.
The October incident demonstrated the calculators' ability to coordinate actions in an emergency. However, the mere fact of the stoppage does not prove that they are all controlled by one organization.
For an objective assessment, it is necessary to determine who initiated the halt in transaction processing, how many independent operators supported the decision, and how the agreement was reached. The technical threshold of 451 votes does not mean that exactly that many participants voted to stop the network.
Unlike open community voting, where all token holders could participate, certain decisions in Qubic fall within the competence of calculators. Therefore, it is important for investors to understand which issues are decided directly by consensus participants and which can be brought to a broader discussion.
The problem lies not in the existence of an emergency intervention mechanism itself, but in the transparency of its application. Users need to know who can restrict network operations, under what circumstances, and what procedures protect them from arbitrary decisions.
How the Hack Affected QUBIC Price and Investor Behavior
The Qubic hack created additional sources of uncertainty for token holders. Besides the risk of losing funds, investors faced restrictions on network operations and temporary unavailability of certain exchange services.
The price of QUBIC following reports of the attack became one of the indicators of market reaction. However, it is impossible to precisely determine the impact of the incident itself without comparing historical quotes, trading volumes, and the overall dynamics of the cryptocurrency market.
For an objective assessment, it is necessary to compare the change in QUBIC's value immediately before the attack and after its disclosure with Bitcoin's movement over the same period. This will help separate potential reactions to specific Qubic issues from overall market fluctuations.
Investors faced two types of uncertainty. The first is related to asset security and the possibility of fund recovery. The second concerns market accessibility: even if tokens remain in the wallet, the suspension of transactions and withdrawal restrictions through exchanges complicate managing investment positions.
Such a situation is particularly sensitive for relatively small cryptocurrencies, where token liquidity may depend on a limited number of trading platforms. After transfers resume, accumulated selling pressure could potentially amplify price fluctuations, although the direction of future movement cannot be predetermined.
Thus, the consequences of the hack should be considered not only through the change in QUBIC's market value but also through users' ability to freely transfer assets, place orders, and conduct transactions.
Why the consequences might be more serious than the theft itself
The financial loss of $1.3 million is not the only indicator of the incident's scale. For the cryptocurrency ecosystem, reputational losses can have more lasting consequences as they affect trust in fund storage technologies and network management mechanisms.
In the case of Qubic, the history of previous security issues takes on special significance. In July 2026, the project already faced a compromise of its software infrastructure related to GitHub.
According to the official technical report from July 14, the attacker first gained access to a project participant's server and then used the stolen credentials to compromise a developer's access token with extended privileges.
As a result, the attacker was able to access eight Qubic repositories and interfere with distributed software components, including the web wallet. The team reported the removal of malicious code, verification of repositories, and replacement of compromised credentials.
The official report did not confirm the theft of user funds, but developers warned of the risk of exposing some web wallet users' secret data.
The July and October incidents had different technical causes, so there is no basis to consider them as one ongoing attack. However, both cases highlight the importance of software infrastructure security, on which users' access to funds depends.
The problem is not limited to Qubic. We previously wrote about how Injective suspended blockchain operations after a suspected attack. Another risk associated with the compromise of cryptocurrency storage tools was discussed in the article on cases of interference with Ledger hardware wallets.
These situations differ in their attack mechanisms but demonstrate a common pattern: the reliability of a blockchain depends not only on its protocol but also on its software, the independence of network operators, and threat response procedures.
Can Qubic regain investors' trust
In a message from October 18, the Qubic team indicated that further decisions on recovering stolen funds are to be made by network participants. However, the mere fact of token blocking does not guarantee compensation for the original owners' losses.
The further development of the situation can be considered through three scenarios:
Restoration of trust. The team publishes a detailed technical report, the network returns to stable operation, and participants make a transparent decision on asset recovery. This reduces uncertainty, although it does not exclude reputational consequences for the project.
Prolonged crisis. Transactions resume, but the compensation mechanism remains a subject of disagreement, and information about the actions of validators is incomplete. In such a case, technical recovery does not necessarily accompany the return of investor trust.
Escalation of problems. Additional vulnerabilities are identified, new transfer restrictions arise, or disagreements regarding network management occur. Such a scenario could increase liquidity risks and user outflows.
The main indicator of recovery will not be the short-term rise in QUBIC's price, but the project's ability to demonstrate that emergency powers are limited by understandable rules and are under the control of independent participants.
The October hack does not prove that Qubic is a centralized system. However, it revealed a fundamental feature of blockchain management: collective intervention can protect users' funds while simultaneously limiting their financial autonomy. The inconvenient truth about decentralization is that a network's ability to quickly respond to threats does not in itself guarantee the independence of its participants. The recovery of funds, transparency of decisions, and distribution of powers among operators will be important conditions for restoring trust in the blockchain.