A blockchain can have a sophisticated consensus mechanism, open-source software and thousands of users. If its wallet software generates predictable secrets, those protections may still fail to safeguard the funds. Qubic has just experienced that scenario. Between 23:42 UTC on October 17 and 01:26 UTC on October 18, an attacker transferred tokens from 1,404 wallet addresses. According to the project, the total reached 2,939,606,531,944 QU. News reports estimated the value at roughly $1.3 million to $1.4 million around the time of the incident. The reported method is more significant than the amount alone. The attacker apparently did not need to break the blockchain's cryptography. Instead, the exploit involved wallet recovery secrets generated with insufficient randomness. That weakness could have existed from the moment the affected wallets were created. Qubic's Computors, the operators responsible for processing network activity, coordinated a blockchain halt. Their objective was to prevent further movement of the stolen assets. According to the project, the intervention immobilized most of the tokens. It has not yet resolved how affected users will recover them.

How a recovery secret can leave a wallet exposed

When someone creates a cryptocurrency wallet, the software generates secret information. That information is used to derive the keys controlling the wallet's assets. It must be practically impossible for another person to predict. The apparent complexity of the displayed recovery phrase is not enough to guarantee security. If its characters come from a predictable random number source, a long secret can still be vulnerable. That is the difference between an arbitrary-looking string and a securely generated cryptographic secret. Qubic's preliminary findings point to the way some wallet versions generated recovery seeds. The implementation reportedly relied on a pseudorandom function unsuitable for cryptographic secrets. In JavaScript, Math.random() can be appropriate for routine applications such as interface effects or non-security simulations. It is not designed for cryptographic key generation. Under certain conditions, an attacker may be able to narrow down possible outputs sufficiently to reconstruct vulnerable secrets. By contrast, crypto.getRandomValues() is intended to provide cryptographically suitable random values in supported environments. Qubic's corrected Web wallet now uses that approach. However, updating the generator does not retroactively improve secrets that were already created.

Which users may be affected?

Qubic identified several environments associated with the vulnerability. The first involves wallet recovery seeds generated in any browser on an iPhone or iPad before October 18, 2026. The second concerns seeds created using Safari on a Mac before the same date. The third involves Qubic's iOS wallet application when it generated seeds before July 2025. This list needs careful interpretation. It does not mean all Apple devices are compromised. Nor does it establish that Safari or iOS was hacked. The issue concerns the wallet software's generation of secret information in certain environments. Owning an iPhone therefore does not automatically make someone a victim. However, users who generated Qubic wallet seeds under the identified conditions should treat those secrets as potentially vulnerable, even if no theft has occurred. There is an important distinction between a drained wallet and a wallet exposed to the same weakness. The 1,404 reported addresses represent the identified thefts. The total number of wallets that may have received insufficiently random secrets has not been established in the public material examined.

1,404 wallets were drained in 104 minutes

Qubic's reported timeline describes a rapid series of unauthorized transfers. The activity began at 23:42 UTC on October 17. It continued past midnight and ended at approximately 01:26 UTC on October 18. That represents around 104 minutes. The project reports almost 2.94 trillion QU removed from 1,404 addresses. The pace suggests organized or automated exploitation, although the full attack tooling and the perpetrator's identity remain unknown. The quantities also require context. QU is Qubic's native accounting unit, while QUBIC is commonly used as the market ticker. An extremely large QU number therefore does not correspond to the same dollar amount. Financial publications estimated the assets at approximately $1.3 million to $1.4 million at the time. That is a market valuation, not proof that the attacker sold the entire amount at that price. The distinction matters when calculating final losses or potential compensation.

The Computors took the entire network offline

Qubic's response was unusually broad. The Computors coordinated a halt at tick 85,371,949. Ticks are the network's processing steps used to order and confirm activity. Stopping their progression interrupts normal transactions. That can be effective during an emergency. Assets remaining on the network cannot continue moving while the halt is maintained. But the decision also affects users who were not involved in the incident. Someone holding funds in a securely generated wallet may still be unable to transact normally. Applications depending on the blockchain can also experience disruption. The trade-off is difficult. Keeping the chain active might allow stolen assets to continue moving. Stopping it can contain the damage, but at the cost of interrupting service for everyone. The intervention also demonstrates how important coordination among network operators becomes during a crisis.

Qubic says 87.1% of the stolen tokens were immobilized

According to Qubic, 87.1% of the stolen QU never left its network and remained immobilized after the shutdown. The other 12.9% reportedly reached cryptocurrency exchange MEXC. Qubic says MEXC froze the receiving account. Cointelegraph reported the breakdown on October 19. If accurate, it means that most of the identified stolen tokens were no longer freely transferable at the time of the announcement. However, immobilization is not the same as recovery. Tokens sitting on a halted blockchain have not automatically been returned to their rightful owners. Likewise, an exchange account freeze does not mean that funds have already been distributed back to victims. Restitution requires additional decisions and procedures. The project must determine the legitimate beneficiaries, validate the affected transactions and decide how balances will be treated when service resumes. Freezing assets can prevent further damage. It does not, by itself, complete the recovery process.

The wallet has been patched, but old seeds remain vulnerable

Qubic released a fix for its Web wallet's recovery-seed generation in version 4.26.4. Technical information reviewed by Cointelegraph indicates that the change replaces Math.random() with crypto.getRandomValues(). That is a meaningful improvement for newly created secrets. But a seed generated in the past does not become more random after the application is updated. The original secret has already been determined. If its creation was predictable, that vulnerability remains. The response therefore has two separate parts. First, the software must stop producing vulnerable wallets. Second, existing users must be protected from the risks associated with previously created recovery seeds. That may eventually require new wallet identities and movement of funds under procedures approved by the project. However, the network halt complicates any immediate transfer. It would be inappropriate to prescribe a universal migration procedure before Qubic establishes and communicates the relevant recovery steps. Updating the wallet is important. It should not be treated as evidence that every old wallet secret is now safe.

Who decides whether victims get their funds back?

The recovery process is now a governance issue. Qubic says its core team is preparing options for consideration by the network's Computors. Those operators are expected to vote on proposals concerning the immobilized assets and possible next steps. That does not mean compensation has already been approved. The technical method, intended beneficiaries and effects on the network's balances still need to be determined. Funds held at MEXC introduce a separate coordination requirement. Restoring assets without creating inconsistencies demands a reliable reconstruction of fraudulent transfers and legitimate ownership. Accountability matters as well. Users need to understand what happened and how the resolution will affect their balances. Transparent procedures will be essential. Qubic has said that a fuller technical report will follow once a recovery plan has been settled. The reporting available on October 19 did not establish a firm restart date or confirm final restitution.

A wallet vulnerability is not necessarily a consensus failure

The central technical distinction concerns where the weakness occurred. Qubic says its consensus protocol itself was not compromised. The vulnerability reportedly existed earlier in the process, when certain wallet seeds were generated. If an attacker reconstructs a valid wallet secret, they may be able to produce signatures accepted by the network. From the blockchain's perspective, those transactions can appear properly authorized. The system cannot necessarily distinguish the legitimate owner from another person who has obtained the same secret. That is what makes weak key generation so dangerous. However, the project's statement does not prove that every other component of the ecosystem is free of vulnerabilities. The full investigation is still required. Qubic has also said that its QEARN staking functionality was unaffected. That statement concerns a particular service. It should not be extended into a universal guarantee covering all associated software.

Beware of fake recovery services

Following a major wallet exploit, users naturally want to know whether their addresses were affected. A community tool called QubicMap offers a way to compare public addresses against an identified list. Its warning is important: checking an address should never require a recovery seed or private key. A public wallet address can generally be shared to identify an account. The secret controlling that account must remain confidential. Scams are a serious concern during security incidents. Fraudulent messages may promise immediate reimbursement, request wallet verification or offer an urgent migration tool. Some websites imitate official project pages. A victim could then lose funds that had not previously been affected. Users should consult Qubic's official communications directly rather than relying on links delivered through private messages. Requests for recovery fees or seed disclosure should also be treated with suspicion. No completed restitution process was established in the material examined. Promises of instant guaranteed recovery would therefore be particularly unreliable.

Decentralization meets emergency intervention

The shutdown raises a question beyond the Qubic incident. Blockchain networks are often promoted as infrastructure that can operate without relying on a single central authority. But major security incidents may demand rapid coordination. When network operators collectively agree to suspend activity, they demonstrate an ability to intervene. That can protect users during theft. It can also concern people who expect uninterrupted access and predictable settlement. Both considerations matter. From a security perspective, immobilizing stolen assets may prevent further losses. From a service perspective, the halt also restricts legitimate users. Governance therefore needs to explain why the action was necessary and how it was authorized. It also needs clear criteria for restarting the network. Confidence depends on more than the ability to respond quickly. It also depends on transparent rules and a resolution process that users can understand.

What remains unknown

Several important facts are now sufficiently documented to explain the immediate crisis. Qubic reports 1,404 drained wallets and almost 2.94 trillion QU removed. The principal transfer window lasted 104 minutes. The identified weakness concerns wallet seed generation in certain environments. The network was stopped at tick 85,371,949. A corrected version of the Web wallet has been released. But key questions remain open. The attacker has not been identified. The total number of wallets exposed to weak seeds, beyond the confirmed victims, has not been definitively established. The final financial loss after any recovery effort is unknown. A firm network restart schedule was not provided in the October 19 reporting examined. The promised technical report will need to explain how the weak generator escaped scrutiny and what additional safeguards have been implemented. It should also clarify the governance decisions governing immobilized funds.

Wallet security begins before the first transaction

The Qubic incident illustrates a vulnerability that ordinary users may find almost impossible to recognize. A long and complicated-looking recovery phrase can inspire confidence. But if the phrase was generated predictably, its appearance means very little. Wallet security begins before the first deposit. It depends on secure implementation, suitable cryptographic randomness and reliable software development practices. Users often have to trust those components without being able to audit them personally. For developers, the lesson is clear: general-purpose pseudorandom functions must not be used to create cryptographic secrets. For network operators, the case shows that a vulnerability outside the consensus protocol can still require a response affecting the entire blockchain. What happens next depends on the Computors' recovery decision, the treatment of frozen assets and the network's eventual restart. Immobilizing most of the stolen funds is a significant reported containment measure. The incident will only be meaningfully resolved when users know which assets can be returned, how their replacement wallets will be protected and when the network can resume normal operation.