Qubic hack: 1,404 wallets drained in 104 minutes, and the chain stopped

Qubic stopped its own blockchain at tick 85,371,949 on Sunday. An attacker had drained 1,404 wallets of 2.94 trillion QU, worth about $1.4m, between 23:42 UTC on Saturday and 01:26 UTC on Sunday. That is 104 minutes, one wallet every 4.4 seconds.

Why Math.random broke it

Nobody guessed those keys. The web wallet built seeds with JavaScript's Math.random, and version 4.26.4 replaced it with crypto.getRandomValues. Mozilla's own documentation says in plain text that Math.random does not provide cryptographically secure random numbers and must not be used for anything security related. The warning has been sitting there for years.

The arithmetic explains the speed. A Qubic seed is 55 lowercase letters, hashed twice with K12 into a 256-bit private key, so the seed alphabet alone allows about 6.6 times ten to the seventy-seventh combinations. A seed drawn from Math.random can never be more varied than the generator behind it, whose internal state runs to 128 bits, or 3.4 times ten to the thirty-eighth. Thirty-nine orders of magnitude of the search space went away before the attacker started work.

Who was exposed

The exposure was narrow and specific: any browser on an iPhone or iPad, Safari on a Mac until 18 October, and the Qubic iOS app before July 2025. Wallets made anywhere else were untouched, which is why 1,404 accounts fell and the rest of the network did not.

“87.1% of the drained funds never left the Qubic network and remain frozen in place.”

— Qubic, Statement on X, 18 October 2026

The money mostly stayed put. Qubic says 87.1% of the stolen tokens never left the chain, and MEXC froze the receiving account holding the other 12.9% within about an hour. Freezing was possible because the validators, which Qubic calls Computors, can halt the ledger outright — a property that recovers funds here and would read as centralisation on any other day.

Put the theft against the token. QU carries a $67.2m market cap and traded $990,925 in the last 24 hours, so the 2.94 trillion stolen coins amount to 2% of circulating supply and more than a full day of trading. The token is up 3.2% over those 24 hours with its own ledger stopped, and down 24.3% over the week.

What settles next

Two recent cases rhyme with this one. A seed reaches an attacker directly when the device is tampered with in the post, and a flaw can sit in production code for years before anyone looks, as the XRP Ledger patch showed this month. Here the Computors still have to vote on a recovery plan, and Qubic has named no restart date.

Informational material, not investment advice. Figures come from Qubic's own statement and from market data read on 19 October 2026, and the recovery vote has not happened yet.