Nobody Hacked Qubic's Chain. Its Seeds Were Just Guessable. 1,404 Wallets Emptied in 104 Minutes, and the Whole Network Is Still Off

Someone emptied 1,404 Qubic wallets in 1 hour and 44 minutes. They didn’t need a smart contract bug or a stolen private key.

They just guessed the seeds.

Qubic’s validators responded by doing something most chains brag they can’t do: they turned the whole network off. As of Sunday night it was still off, with no restart date announced.

---

What Happened

Here’s what both CryptoTicker and TechReport report:

Drain window	23:42 UTC Oct 17 → 01:26 UTC Oct 18 (~104 min)
Wallets hit	1,404
Stolen	~2.94 trillion QU, about $1.3M at the time
Chain halted at	Tick 85,371,949
Patched client	v4.26.4
Restart date	Not announced

According to Qubic’s developers, the chain code wasn’t attacked. The problem is how some wallets generated their recovery seeds. Not enough randomness went in, so the seeds came out predictable. And if you can predict a seed, you don’t need to hack anything. You just log in.

---

Who’s Exposed

Per CryptoTicker, Qubic says these seeds are affected:

• Seeds created before October 18, 2026 in any browser on an iPhone or iPad
• Seeds created before October 18, 2026 in Safari on a Mac
• Seeds created before July 2025 in the Qubic iOS app

CryptoTicker says the list “may grow.”

The uncomfortable part: the patch fixes how new seeds get made. It doesn’t make an old weak seed strong. If yours came from one of those routes, the fix is a new seed and moving your funds. Updating won’t do it.

---

Where the Money Is

Some of it didn’t get far.

• About 87.1% of the stolen QU is still on-chain and stuck because of the halt, per Crypto Briefing (cited by both outlets).
• About 12.9% made it to MEXC, which froze the receiving account within an hour.
• Qubic’s devs say they moved other at-risk balances before the attacker could reach them.
• QEARN, Qubic’s staking/lockup program, was not touched.

MEXC and Bitget have both suspended QUBIC deposits and withdrawals. As of October 18, CryptoTicker had QU down 13.6% on the day, at about $61.4M market cap.

So the network halt worked as a freeze. The catch is that it froze everyone else too.

---

The Refund Question Nobody Has Answered

Nothing has been decided on compensating victims. Both outlets say the call sits with Qubic’s validator (Computor) cluster, not with a company. TechReport says affected users are being told to file police reports.

So a chain that can stop itself in a night still can’t say whether 1,404 people get their money back.

---

Wait, That Qubic?

Yep. Qubic is the useful-proof-of-work project that made headlines in August 2025 when it claimed 51% of Monero’s hashrate. That happened during a six-block Monero reorg. Analysts, including BitMEX Research, doubted it really held a majority, and several exchanges paused XMR withdrawals anyway.

A year later, its own users’ wallets fell over on something much more basic: a random number that wasn’t random enough.

---

Why This Matters for Crypto Jobs

Entropy is a security discipline, not a library call. “Works in the browser” and “generates a secure seed” are two different claims, and only one of them got tested here. Teams building wallets need client-side security and cryptography engineers who audit seed generation on every platform, Safari and iOS WebKit included, not just Chrome on a dev laptop.

Auditors need to look past the contracts. The chain code held. The wallet layer didn’t. Firms that only scope on-chain code are missing the layer where this happened. Wallet and key-management auditors are in short supply.

Incident response pays for itself. Halt within hours, at-risk balances moved, and an exchange freeze within an hour stopped most of the money leaving. Someone had to coordinate all of that overnight. IR, on-chain monitoring and exchange risk teams are why most of the $1.3M didn’t disappear.

Governance is now an ops role. Refunds depend on a validator vote, not a company decision. Protocols need people who can run governance, validator relations and treasury when the “who pays?” question comes up, and it always does.

---

The Bottom Line

If you made a Qubic seed on an iPhone, iPad or Mac Safari before October 18, or in the iOS app before July 2025, treat it as burned. Make a new seed on the patched client when the network’s back and move everything. And for the rest of crypto: you can audit your consensus layer for years and still lose users to a bad random number.

---

Want to build the wallets, audits and incident-response systems that catch this before 1,404 people find out? Browse open security and engineering roles on Cryptogrind →