Qubic, a layer-1 blockchain network, froze its operations on Sunday after an attacker exploited weak wallet seeds to steal approximately $1.4 million from over 1,400 accounts. The vulnerability affected wallet seeds generated using any browser on an iPhone or iPad, Safari on a Mac until October 18, 2026, or the Qubic iOS app before July 2025. The attack resulted in the theft of 2.94 trillion Qubit (QU), with 87.1% of the drained funds remaining frozen on the Qubic network. The remaining 12.9% was sent to MEXC, which froze the receiving account within about an hour.
Qubic has since fixed the seed-generation flaw in the latest version of its web wallet by replacing JavaScript’s Math.random() function with the cryptographically secure crypto.getRandomValues() function. The core team is currently identifying affected wallets and preparing recovery options for a vote by the network’s Computors, who will decide the fate of the frozen funds. A full technical report will be published after a recovery plan is settled, though no restart date for the network has been announced.
The Qubic theft is part of a broader trend of attacks tied to weak wallet seeds. In July, Coldcard disclosed a similar exploit, while Trust Wallet’s browser extension and the Libbitcoin Explorer tool faced similar flaws in 2023. Qubic’s token had a market capitalization of about $62.6 million at the time of writing, according to CoinGecko.
In the third quarter, hacks and exploits accounted for 19% of crypto crime cases but 40% of reported losses, according to AMLBot’s 2026 investigations report. The report analyzed 250 investigations opened since the start of the year, highlighting the ongoing risks in the crypto space.