Weak seeds, 1,404 emptied wallets: Qubic freezes its entire blockchain to trap most of about $1.3 million in stolen tokens

Qubic, a layer-1 blockchain whose mining work is used to train AI models, has halted its network to stop a thief. An attacker drained 1,404 user wallets of about 2.94 trillion QU over roughly an hour and three-quarters from late Saturday UTC, worth about $1.3 million to $1.4 million depending on the outlet, and validators halted the chain at tick 85,371,949 to freeze what had not yet left, according to Cointelegraph, Crypto Briefing and Tech Report.

The weakness was in how some wallets made their seeds, not in the chain. Qubic said seeds generated in any browser on an iPhone or iPad, in Safari on a Mac until October 18, or in the Qubic iOS app before July 2025 were predictable. A GitHub commit for client version 4.26.4 swaps JavaScript's Math.random(), which was never designed for secrets, for crypto.getRandomValues(), Cointelegraph reported. The team said it secured other exposed funds before they could be taken and that its QEARN staking feature was untouched.

Qubic says 87.1% of the drained funds never left its network and remain frozen in place, per Cointelegraph and Crypto Briefing. The other 12.9% went to MEXC, which froze the receiving account within about an hour. MEXC and Bitget have suspended QUBIC deposits and withdrawals.

What comes next rests with the Computors, the operators who run the network: the core team is preparing recovery options and the Computors will vote on what happens to the frozen funds, including whether victims are compensated, with a full technical report to follow and no restart date. Affected users have been told to file police reports. It is Qubic's second incident this year after August's Vottun Bridge exploit; the token's market value was about $62.6 million on Sunday, per CoinGecko data cited by Cointelegraph.