Qubic's Wallet Seeds Weren't Random Enough: 1,404 Wallets Drained, Then the Chain Hit Pause
This was not a blockchain exploit but a dice-rolling problem: the seeds used to generate some wallets were not random enough, and 1,404 wallets paid for it.
Three key facts
Qubic disclosed on October 18 that the transfers took place between 23:42 UTC on October 17 and 01:26 UTC on October 18. Attackers exploited weak randomness in some wallet seeds to move about 2.94 trillion QU from 1,404 wallets, worth roughly $1.3 million at the time. The flaw was in seed generation, not the Qubic protocol itself.
The affected seeds are specific. They include seeds generated in any browser on an iPhone or iPad before October 18, seeds generated in Mac Safari on October 18, and seeds generated through the Qubic iOS app before July 2025. Qubic says the issue was fixed in version 4.26.4.
The response was to stop the chain. Validators paused the network at tick 85,371,949. About 87.1% of the stolen funds remain on the halted network and are frozen; the other 12.9% had reached MEXC, where the receiving accounts were also frozen. The Computor cluster will decide whether affected wallet holders get compensation under network rules; QEARN staking was unaffected.
Wang Dou's Take
The sharpest part is this: the seeds looked random but were not, so the wallets were a row of bicycles with broken locks. Between 23:42 and 01:26, someone rode off with 1,404 of them and emptied 2.94 trillion QU from the baskets.
Then the validators hit pause. 87.1% of the tokens are still on-chain, but nobody can spend them; 12.9% had already reached an exchange, where MEXC froze it. At the critical moment, the safety net was not the code. It was the validators on duty and an exchange's risk desk.
This is not an argument against hitting pause. At that hour, stopping the bleeding is common sense. It is an argument against pretending decentralization has no center. Decentralization is not the absence of a center; it is a center that usually stays out of sight. A chain that can pause for security can pause for other reasons too. The difference is not the code; it is who holds the button.
For users, the number to remember is not $1.3 million. It is the phrase "seeds generated in an Apple browser or the old Qubic iOS app." A wallet can be upgraded; a leaked seed cannot be un-leaked. A chain can pause; trust does not come back on the same timetable.
Source: TokenPost