Predictable Qubic wallet seeds from Apple browsers and early iOS app let attacker drain 1,404 wallets (~$1.3M)

Summary

Qubic reported that between 23:42 UTC on 2026-10-17 and 01:26 UTC on 2026-10-18 an attacker moved about 2.94 trillion QU (about $1.3M at the time) out of 1,404 user wallets. Qubic attributes the theft to wallet seeds generated with insufficient randomness, which made them predictable. The project says the fault was in seed generation, not in the Qubic protocol. Computors (validators) halted the network at tick 85,371,949.

Affected

• Qubic wallet seeds created in any browser on an iPhone or iPad before 2026-10-18
• Qubic wallet seeds created in Safari on a Mac before 2026-10-18
• Seeds created in the Qubic iOS app before July 2025
• Fixed in wallet version 4.26.4. Per reporting, the fix covers newly generated seeds only, so seeds created earlier stay weak.

Impact

An attacker who can reproduce the predictable seed space can derive the private keys of affected wallets and move their funds. Exploitation in the wild is confirmed: 1,404 wallets were drained. Qubic says about 87.1% of the stolen QU is still on the halted network. The remaining ~12.9% reached MEXC, which reportedly froze the receiving account. Qubic also says its developers secured additional vulnerable balances before the attacker reached them. QEARN staking was reported as unaffected. Bitget suspended QUBIC deposits and withdrawals. Next steps, including any restitution, are up to the Computor quorum. Qubic says a full technical report will follow once the recovery plan is final.

Recommended actions

• Users holding seeds created under the conditions above: treat them as compromised. When the network resumes, follow Qubic's official instructions to move funds to a new seed generated with version 4.26.4 or later.
• Affected holders: Qubic asks you to report to police or cybercrime authorities with your wallet ID, amount lost and the explorer transaction link.
• Exchanges: watch for inbound QU tied to the incident and follow Qubic's guidance on resumption.
• Beware of follow-on scams. Qubic says its team will never message users privately, ask for a seed, or offer paid recovery services.

Indicators

None published. No primary source has named attacker identities or transaction IDs.

Source & attribution

This 0xCERT advisory summarises Qubic's own incident report (https://x.com/_Qubic_/status/2111796725677715474), as reported by Bitcoin.com News (https://news.bitcoin.com/security/qubic-loses-1-3-million-in-wallet-raid-before-network-halts/), Crypto Briefing (https://cryptobriefing.com/qubic-halts-mainnet-wallet-drain/) and The Defiant (https://thedefiant.io/news/hacks/qubic-halts-network-after-1-3-million-wallet-drain). Details may change; refer to Qubic's official channels for the authoritative record.