Qubic halts chain after attackers exploit weak seeds to steal about $1.3 million from 1,404 wallets

Layer1 blockchain network Qubic suspended operations on Sunday after attackers exploited a weak-randomness flaw in wallet seed generation to steal 2.94 trillion native QU tokens from 1,404 wallets within 104 minutes, worth about $1.3 million at the time. According to a statement by the project on X, the attack occurred between 7:42 a.m. and 9:26 a.m. Beijing time on Oct. 18. The flaw affected seeds generated in any browser on iPhone or iPad, in Safari on Mac before Oct. 18, and in the Qubic iOS app before July 2025; the project said the flaw was in the seed-generation tool rather than the chain protocol itself, and that version 4.26.4 replaced the insecure Math.random() with a cryptographically secure random number function. Of the stolen funds, 87.1% remains on the Qubic chain and has been frozen as the network is suspended, while the remaining 12.9% was transferred to the MEXC exchange, which froze the receiving accounts in about one hour. After the attack, QUBIC fell more than 10%, and Bitget and MEXC suspended trading and deposits and withdrawals for the token. Qubic said its validators, the Computors, will vote on how to dispose of the frozen funds, and no restart time for the network has been set.