Qubic Freezes a Working Chain Over Guessable Seeds

Qubic stopped its Layer 1 at tick 85,371,949 on October 18, 2026, after an attacker emptied 1,404 wallets of about 2.94 trillion QU, worth about $1.4 million. The protocol was not cracked. Seeds built with JavaScript’s Math.random() on Apple browsers and an older iOS app were weak enough to rebuild, and the halt that trapped 87.1% of the stolen QU also stopped every other transfer on the network.

Qubic, the AI-linked Layer 1 founded by Sergey Ivancheglo, posted the incident thread at 12:29 UTC on October 18. No restart time was attached. A Discord poll is open so Computors can see where holders stand before they vote.

1,404 Wallets Emptied in 104 Minutes

The drain ran from 23:42 UTC on October 17 to 01:26 UTC on October 18, a window of 104 minutes. Qubic said the attacker did not brute-force an open-ended keyspace. Seeds created with weak randomness were rebuilt, then wallets that still held QU were emptied.

That is a wallet failure sitting on top of a live ledger. Qubic put it in one line: the issue was in seed generation, not in the Qubic protocol itself.

THE 104-MINUTE DRAIN

1. October 17, 2026, 23:42 UTC: Unauthorized transfers begin across Qubic wallets.
2. October 18, 2026, 01:26 UTC: The drain stops after 1,404 wallets and about 2.94 trillion QU have moved.
3. October 18, 2026: Computors halt the network at tick 85,371,949. MEXC freezes the account that received 12.9% of the drained QU. Bitget pauses QUBIC deposits and withdrawals. Web wallet 4.26.4 ships.
4. October 18, 2026, 12:29 UTC: @_Qubic_ publishes the incident thread and opens a Discord poll for Computors.
5. October 19, 2026: MEXC customer support restates that QUBIC deposits and withdrawals stay closed at the project’s request.

Holders who tried to send QU to another Qubic wallet after the halt found the same wall as the thief. With no ticks advancing, nothing moves, stolen or not.

The Seeds Were 55 Letters From Math.random()

A Qubic seed is 55 lowercase English letters. The web wallet’s old generator built that string in a tight loop. For each of the 55 positions it took Math.floor of Math.random() times 26 and picked from a to z. The replaced Math.random in seedGen commit shows that loop deleted on October 18, replaced by a helper that reads Web Crypto and rejects biased bytes.

MDN’s JavaScript reference has warned for years that Math.random() does not provide cryptographically secure random numbers and should not be used for anything related to security. The documented stand-in is Crypto.getRandomValues(). Qubic’s patch now calls that API, maps bytes onto 26 letters without favoring some characters, and throws if the secure source is missing.

Math.random() does not provide cryptographically secure random numbers. Do not use them for anything related to security. Use the Web Crypto API instead, and more precisely the Crypto.getRandomValues() method.

MDN Web Docs, Math.random() reference

Safari and other WebKit browsers have long used a Math.random() implementation that is fine for layout jitter and terrible for secrets. An attacker who knows the generator, and who can bound when a wallet was created, does not need to try 26 to the 55th power. They reconstruct the smaller set of seeds that generator actually produced, then watch which of those addresses hold QU.

Which Qubic Seeds Are Exposed?

Qubic’s warning is narrow. It names three creation paths, not every Apple device and not every Qubic wallet. Seeds made on those paths should be treated as known, even if the balance was later imported somewhere else.

SEEDS QUBIC SAYS TO TREAT AS WEAK

• iPhone or iPad browsers: Any browser on those devices, if the seed was created before October 18, 2026.
• Safari on a Mac: Seeds created in Safari before October 18, 2026.
• Qubic iOS app: Seeds created in that app before July 2025.

A firmware or app update does not rewrite a seed that already exists. Version 4.26.4 stops new weak seeds. It does not make an old 55-letter string secret. Once the chain moves, those identities need a fresh seed from the patched generator, then a move of any remaining QU. Reusing the old string in another app copies the same hole.

The GitHub tag is the web wallet. Qubic’s cryptographically secure seed generation notes for 4.26.4 are dated October 18, 2026. Store listings for the iPhone app use a different numbering scheme, so matching “4.26.4” on a phone screen is the wrong test. The test is how and when the seed was created.

Computors Halted a Chain That Was Not Broken

Qubic does not group transactions into blocks. It advances in ticks, each a network state that has to be agreed before it is final. Docs put a tick at roughly a second, with finality when a quorum signs the same vote. If Computors stop agreeing, ticks stop, and the Spectrum, Qubic’s ledger, stops moving.

That is what happened at tick 85,371,949. Qubic said Computors coordinated a protective halt so the drained funds could not be moved or sold while the incident was handled. The same switch also parked every honest payment, every exchange deposit, and every contract call that needed a later tick.

The people who can restart it are the same set that produce ticks. Qubic seats 451 of the 676 Computors as the quorum that must agree for a decision to count. Recovery options, including what to do with frozen QU, go to that vote. The core team said it is listing every affected identity and preparing those options. The Discord poll is input, not the decision.

NETWORK SNAPSHOT AFTER THE HALT

• Frozen tick: 85,371,949, with no transactions processing.
• Quorum that must act: at least 451 votes from 676 Computors.
• Cause named by Qubic: seed generation, not the protocol.
• Restart: none announced as of October 19, 2026.

Ivancheglo’s network sells itself on feeless transfers and useful proof of work for AI training. None of that ran while the tick clock was stopped. The irony is mechanical. Consensus worked well enough to freeze the thief, and in doing so it froze everyone else.

87.1% of the Stolen QU Never Left

Qubic’s split is unusually clean for a drain of this size. 87.1% of the drained QU never left the network and remains frozen at the halted tick. The other 12.9% was sent to MEXC, which Qubic said froze the receiving account within about an hour.

WHERE THE DRAINED QU SAT

MEXC later said it had suspended QUBIC deposits and withdrawals at the project team’s request. Bitget, in a support notice timestamped 13:31 UTC+8 on October 18 (05:31 UTC), said it would suspend QUBIC deposits and withdrawals for wallet maintenance, with resumption to be announced separately. Neither desk posted a restart clock. Route trackers on October 19 still showed those rails closed, along with several other QUBIC pairs.

Containment is not recovery. Frozen QU is still sitting in drained identities or in a frozen exchange account. Getting it back to the 1,404 owners is a Computor decision, not an automatic unwind. Qubic asked affected users to file police or cybercrime reports in their own countries, with wallet ID, amount, and the transaction link from explorer.qubic.org, because those filings help exchanges keep the 12.9% frozen.

Coldcard and XRPH Already Paid This Bill

Guessable seeds were a 2026 problem before this halt. In late July, attackers swept Bitcoin from Coldcard wallets whose firmware had, since March 2021, mixed in a software generator instead of the hardware random chip. TRM Labs put that drain at about 1,816 BTC, worth about $116 million, across more than 5,200 addresses. Updating firmware did not repair those seeds either. Owners had to move coins to a newly generated seed.

On September 3, 2026, XRPH Wallet, the app shipped by XRP Healthcare, lost about $452,000 from 4,011 wallets in a few hours. The project’s own root-cause write-up said a 55-character string was fed into a function that expected raw bytes, collapsing the keyspace to about 2^46. That report also noted Math.random() in the digit path, which could only shrink the set further. Funds left the XRP Ledger and settled as DAI on Ethereum. XRP Healthcare later moved to wind down.

THREE WEAK-SEED DRAINS IN 2026

Qubic’s loss is the smallest of the three in dollars and the only one that took a whole Layer 1 offline. That is the trade. Coldcard and XRPH left their ledgers running and watched coins leave. Qubic stopped the clock, kept 87.1% in place, and put every other user in the same queue as the victims.

Recovery Now Goes to a Computor Vote

Qubic’s next step is political by design. “Any resolution is a decision for the Computor quorum, under the rules of the network,” the project wrote. The core team is identifying affected identities and preparing options. A full technical report, it said, will follow once recovery is settled.

Until that vote, the practical advice is ugly and specific. Anyone who created a seed on the listed Apple surfaces should assume that string is public to whoever ran the reconstruction. A new seed from 4.26.4 or another generator that uses Web Crypto is the replacement, after ticks resume. Do not type the old 55 letters into a “recovery helper.”

Nobody from Qubic will ever message you first, ask for your seed, or offer recovery services for a fee. Report any such messages.

Qubic, official incident thread on X

The same thread is the primary record of the halt, the 87.1% figure, and the three affected creation paths:

Security incident update.

Between 23:42 UTC on 17 October and 01:26 UTC on 18 October, an attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU.

Here is what happened, what has been done, and what comes next. pic.twitter.com/7aPJ26lEeZ

— Qubic (@_Qubic_) October 18, 2026

On October 19 the chain was still sitting on tick 85,371,949. Exchange rails were still closed. The Discord poll was still the only public signal of how Computors might vote. The stolen QU that never left Qubic cannot move until those 676 machines agree to start the clock, and to decide who that frozen balance belongs to.

Disclaimer: This article is news reporting on a blockchain security incident and is for information only. It is not investment advice, not legal advice, and not a recommendation to buy, sell, hold, or move QUBIC or any other token. Readers who hold Qubic wallets, especially seeds created on iPhone or iPad browsers, Safari on a Mac, or the Qubic iOS app in the windows Qubic named, should consult a qualified cryptocurrency security professional and, where funds were stolen, local cybercrime authorities before they act. Figures, exchange status, and the network halt reflect Qubic’s October 18, 2026 thread and related primary pages as of October 19, 2026, and those facts can change when Computors vote or when desks reopen rails.