Qubic Suspends Blockchain Operations After $1.4 Million Token Theft

The Qubic blockchain has been suspended after an attacker exploited a wallet vulnerability and stole approximately 2.94 trillion QU tokens worth about $1.4 million from over 1,400 accounts. The Qubic team reported this on October 18, 2026.

The attack targeted wallets whose seed phrases were generated with insufficient randomness, leaving private keys vulnerable to recovery. The network was halted at tick 85,371,949 to prevent further movement of the stolen tokens. At the time of the halt, 87.1% of the funds remained in the network, while the remaining 12.9% had already reached the MEXC exchange, which froze the receiving account about an hour later.

Qubic has not specified a date for resuming operations: the return of assets awaits a decision from the network operators – Computors. Vulnerable wallets were those created through any browser on iPhone or iPad until October 18, 2026, through Safari on Mac until the same date, and through the Qubic app for iOS until July 2025. The issue was with the wallet software, not the blockchain protocol. In the web wallet version 4.26.4, developers replaced Math.random() with crypto getRandomValues(), but did not confirm that previously created phrases are secure.

At the time of the halt, approximately 2.56 trillion QU remained in the blockchain, while another 379.26 billion QU had moved to MEXC. The exchange suspended QUBIC deposits and withdrawals at the project's request; XT introduced a similar suspension for QUBIC and KASPLEX networks on October 18. Qubic has not confirmed the return of the stolen tokens. The team is identifying compromised wallets and preparing proposals for voting by Computors – the consensus operators who will decide the fate of the frozen funds. It has not yet been decided whether this will be a reversal of transfers, a return through another mechanism, or separate compensation. A full technical report is promised after the plan is approved.

The Qubic network operates on Useful Proof of Work – a consensus directing miners' computations to AI tasks. The project's capitalization at the time of the report is about $62.6 million (CoinGecko). The case continues a series of incidents involving weak seed phrase generation: in July 2026, due to Coldcard firmware, approximately 594 BTC worth $38 million was stolen from ~500 wallets, in August 2023, the Libbitcoin Explorer (Milk Sad vulnerability) cost over $900,000, and in April 2023, Trust Wallet – about $170,000. According to AMLBot, in the third quarter, hacks and exploits accounted for 19% of criminal cases but 40% of financial losses.