A blockchain can freeze a thief’s exit without giving victims their money back. Qubic says a weak-randomness flaw let an attacker drain 1,404 wallets; now the network’s emergency controls and recovery process face the harder test.
Qubic says the theft ran from 23:42 UTC on 17 October to 01:26 UTC on 18 October, draining 1,404 wallets and around 2.94 trillion QU. The 104-minute duration is calculated from the project’s timestamps, not independently established forensic timing. The network was halted; now the question is who can decide what happens to stranded funds, and on what evidence.
The project blames weak randomness in seeds generated in certain environments. The Qubic wallet seed vulnerability is reflected in a published code change, but the complete attack path is not independently confirmed. This is a security incident becoming a test of network governance.
1,404 wallets, one reported seed-generation weakness
In its incident statement, Qubic said an attacker drained 1,404 Qubic wallets, totalling approximately 2.94 trillion QU. The reported period crosses midnight, running from 23:42 UTC on 17 October to 01:26 UTC the next day. Qubic’s account makes the 2.94 trillion QU theft the central measure; dollar estimates in outside coverage vary and depend on the valuation time, so a single dollar figure would imply more precision than the evidence supports.
Qubic attributes the incident to insufficient randomness in certain wallet seeds. It lists seeds generated in an iPhone or iPad browser before 18 October 2026, Mac Safari before that date, or the Qubic iOS app before July 2025. That is not a finding that every Apple device, every browser or every cryptocurrency wallet was affected. The stated scope is narrower and should remain so until the promised technical report supplies more detail.
This is a wallet-generation issue, not evidence that every Qubic account or its consensus system failed. But a wallet is the user’s practical security boundary: if its seed can be reproduced, decentralised settlement cannot protect its owner.
Qubic’s published wallet code patch removes seed generation based on Math.random() and routes generation through a new utility using crypto.getRandomValues(). The patch includes tests for secure randomness and fail-closed behaviour. This is tangible evidence that the project changed its wallet code, not independent proof of every step in the alleged exploit.
A halted network is containment, not restitution
Qubic says Computors halted the network at tick 85,371,949. At the time of the Scout check, the Qubic explorer showed that tick as unprocessed and listed 85,371,947 as the last processed tick. That is a point-in-time observation consistent with the reported halt, not a guarantee that the network remains in the same state indefinitely.
Qubic also says 87.1% of the drained funds remained on its network and were frozen, while 12.9% went to MEXC; the project says the exchange froze the receiving account within about an hour. Those percentages describe claimed containment, not returned funds. An immobilised balance is not restitution: affected users still need an agreed method for identifying claims, authorising any transfer and showing that the same coins are not paid out twice.
The Qubic network halt in October 2026 is a governance story as much as a security incident. It may buy time, but places users’ options behind emergency controls. Qubic says any resolution belongs to a Computor quorum “under the rules of the network”. Those rules allocate authority; they do not prove a remedy is fair.
The patch is evidence of a fix, not a complete post-mortem
Cointelegraph independently reported the halt, the seed issue and the published wallet patch, while noting that recovery remained subject to a Computor vote and no restart date had been announced. Its reporting strengthens the case that Qubic took visible containment and remediation steps. It does not substitute for a full forensic account or independently verify every reported fund movement.
The Qubic wallet patch v4.26.4 is a checkpoint, not a post-mortem. Its change addresses a seed-generation weakness in the edited code. Questions remain: which identities were affected, how seeds became exploitable, whether all relevant versions are covered, and how users can verify inclusion.
Do not turn Qubic’s claim that 87.1% of funds are frozen into a claim that they are recovered. It is a status claim about funds said to remain on-chain. The separate 12.9% MEXC account-freeze claim needs exchange confirmation or other verifiable evidence before it can be called recovery.
The quorum must make recovery legible
Qubic says its core team is identifying affected identities and preparing recovery options for a Computor quorum. A full technical report will follow once the plan is settled, the project says. The urgent task is to explain the process before asking users to accept its outcome.
A credible plan should distinguish known facts from claims, explain how affected identities will be verified, publish the quorum threshold, and address duplicate claims and appeals. It should state what the halt protects and what it does not. These are standards to demand, not steps Qubic has confirmed.
There is a trade-off: a rushed reversal could reward an incorrect claimant, while a prolonged freeze leaves legitimate users without access. Qubic may have bought time by stopping activity; it has not yet shown that emergency power can deliver a transparent, verifiable remedy.
The next meaningful milestone is not simply a restart date. It is a public technical report, a documented quorum decision and evidence that any promised recovery reaches the right users. Until then, Qubic has reported a patch and containment; whether it can deliver accountable recovery remains open.
Qubic’s security response will be judged not only by what it froze, but by what it can prove it returned.
