Qubic Shuts Down Blockchain After Wallet Exploit Steals $1.4 Million
The cryptocurrency Qubic has shut down its layer-1 blockchain after hackers exploited a security issue in users’ wallets. The attackers stole about 2.94 quadrillion QU tokens worth $1.4 million (roughly Rs. 13.3 crore). According to an official statement from the Qubic Core Team dated October 18, the attacker targeted wallets with weak seeds caused by insufficient randomness. This weakness allowed the hackers to discover private keys. The network paused at tick 85,371,949 to stop further transfers of the stolen tokens.
Details of the Exploit and Funds Movement
Qubic reported that 87.1 percent of the stolen funds remained inside the system until the network stopped. The remaining 12.9 percent had already been transferred to the cryptocurrency exchange MEXC. The project said the exchange blocked the receiving account in less than one hour. Qubic has not announced when the blockchain will restart. Recovery of the stolen assets is still pending a decision from the network operators, known as Computors.
The vulnerability involved a weakness in how certain Qubic wallets created recovery seeds. Poor randomisation during seed generation made it easier to reverse-engineer the private key. Attackers could then access the wallet without knowing the recovery phrase. Qubic grouped the compromised wallets according to the device, browser, and application used to generate the seed.
Network Freeze and Exchange Response
The network freeze left most of the stolen tokens locked until the development team completes a recovery plan. According to figures provided by Qubic, approximately 2.56 trillion QU remained on the blockchain after transactions stopped. The remaining 379.26 billion QU had moved to MEXC. After the project contacted the exchange, the receiving address was locked. Qubic then halted QUBIC deposits and withdrawals on MEXC at the exchange’s request. This step prevented further movement of tokens during the investigation.
Fix and Next Steps
Qubic stated that the seed generation vulnerability has been fixed in the latest version of its web wallet. According to a GitHub commit for version 4.26.4, the wallet now uses crypto.getRandomValues(), a cryptographically secure method for generating random values, instead of JavaScript’s Math.random() function.
The core team is working to identify affected wallets and develop recovery solutions for approval by the network’s Computors. The team said it will release a complete technical report once the recovery solution is finalised. It has not yet announced when the network will resume operations.
The incident highlights ongoing risks tied to wallet seed generation in cryptocurrency projects. Further updates on recovery and network restart are expected from the Qubic team.