Qubic Loses $1.3M as 1,404 Wallets Drained in Seed-Randomness Attack, Network Halted
Published October 18, 2026, 10:30 PM PKT. Based on Qubic's official incident report published on X on October 18, 2026 (primary source), news.bitcoin.com's October 18, 2026 report (secondary source), KuCoin's news flash published October 18, 2026 (secondary source), BBX's October 18, 2026 report (secondary source), and reports by ChainCatcher and The Coin Rise published October 18, 2026 (secondary sources).
Qubic has halted its network after an attacker drained 1,404 wallets of roughly 2.94 trillion QU, worth about $1.3 million, in a 104-minute raid between 23:42 UTC on October 17 and 01:26 UTC on October 18, 2026. The project's validators, known as Computors, stopped the network at tick 85,371,949 once the theft was detected, according to Qubic's official incident report.
The culprit was not a flaw in the blockchain itself. Qubic says the attacker exploited insufficient randomness in the generation of the network's 55-character wallet seeds, reconstructing a set of predictable seeds and identifying wallets that held funds. The seed-generation issue has been corrected in version 4.26.4, and Qubic says its developers also moved vulnerable funds out of reach before the attacker could take them.
The 104-minute drain: 1,404 wallets, 2.94 trillion QU
Qubic reported that the unauthorized transfers ran from 23:42 UTC on Saturday to 01:26 UTC on Sunday, emptying 1,404 wallets in under two hours. The haul of about 2.94 trillion QU was valued at roughly $1.3 million at the time, according to news.bitcoin.com's report, which cited Qubic's statement.
The network halt came early Sunday. By pausing transactions at tick 85,371,949, the Computors cut off the attacker's ability to move more funds, leaving the bulk of the theft trapped inside the frozen network.
Predictable seeds on old Apple devices
According to Qubic, the wallets caught up in the raid shared a common trait: their seeds had been generated on iPhones and iPads through web browsers, on Macs running Safari, or in older versions of Qubic's own iOS application, where the seed generation lacked enough randomness. Rather than guessing an astronomical number of possible combinations, the attacker appears to have reconstructed the smaller set of predictable seeds those older tools produced.
Qubic emphasized that the issue sits in the wallet seed-generation mechanism, not in the Qubic protocol itself. The fix shipped in version 4.26.4, KuCoin's news flash reported, citing the project's statement.
The heist got trapped: 87.1% stuck, 12.9% frozen by MEXC
The attack's aftermath created an unusual situation for the thief. About 87.1% of the stolen QU never left Qubic and now sits immobilized on the paused network, according to Qubic's figures. The remaining 12.9% reached the cryptocurrency exchange MEXC, which froze the receiving account, BBX reported.
QEARN staking positions were unaffected by the raid, according to the project. Separately, Bitget suspended QUBIC deposits and withdrawals, citing maintenance, ChainCatcher reported.
What happens next: the Computor quorum decides
Whether the drained wallets get their funds back is now in the hands of Qubic's Computor quorum, the validator set that governs the network. The project says the quorum will decide on restitution for the 1,404 affected wallets.
The token price felt the impact quickly. Qubic's native currency was down more than 10% at 10 a.m. Eastern time on Sunday, news.bitcoin.com reported.
The incident adds to a turbulent recent history for the project. Qubic was founded by Sergey Ivancheglo, known as "Come-from-Beyond," an early blockchain developer associated with NXT and IOTA. The project drew controversy in 2025 after claiming majority control of Monero's mining hashrate, followed by blockchain reorganizations that alarmed the privacy coin's community.
This article is news reporting and is not investment advice.
Sources
- Qubic official incident report, October 18, 2026, primary source: unauthorized transfers between 23:42 UTC October 17 and 01:26 UTC October 18 drained approximately 2.94 trillion QU from 1,404 wallets; Computors halted transactions at tick 85,371,949; cause was insufficient randomness in 55-character wallet seed generation, not the Qubic protocol; affected seeds generated on iPhones and iPads through browsers, Macs running Safari, and older versions of the Qubic iOS app; issue corrected in version 4.26.4; developers secured other vulnerable funds before the attacker reached them; approximately 87.1% of stolen QU remains immobilized on the paused network; 12.9% reached MEXC and was frozen; QEARN stakes unaffected; restitution decision rests with the Computor quorum
- news.bitcoin.com, October 18, 2026 (11:00 AM EDT), secondary source: 1,404 wallets drained of roughly 2.94 trillion QU worth about $1.3 million in under two hours; predictable seeds generated by older Apple software identified as the cause; network halted early Sunday October 18; QUBIC down more than 10% at 10 a.m. Eastern Sunday; MEXC froze receiving account; Bitget suspended QUBIC deposits and withdrawals for maintenance; project founded by Sergey Ivancheglo ("Come-from-Beyond"), early NXT/IOTA developer, controversial 2025 claim of Monero hashrate majority control followed by reorganizations
- KuCoin news flash, October 18, 2026 (15:33 UTC), secondary source: attackers exploited insufficient randomness in certain wallet seeds to access and transfer approximately 2.94 trillion QU from 1,404 Qubic wallets between 23:42 October 17 and 01:26 UTC October 18; project team emphasized the issue lies in the seed generation mechanism, not the Qubic protocol
- BBX, October 18, 2026 (02:53 UTC), secondary source: from 23:42 to 01:26 UTC October 18, attackers exploited wallet seed randomness vulnerability, transferring approximately 2.94 trillion QUBIC from 1,404 wallets; network suspended at tick 85,371,949; 87.1% of stolen funds frozen within the network, remaining 12.9% transferred to MEXC accounts also frozen; seed issue resolved in version 4.26.4
- ChainCatcher, October 18, 2026, secondary source: 1,404 wallets stolen totaling about $1.3 million, network suspended; unauthorized transfers between 23:42 and 01:26; predictable seeds from older Apple devices and browsers; 87.1% remains in paused network, 12.9% frozen at MEXC; Bitget suspended QUBIC deposits and withdrawals; QEARN staking unaffected
- The Coin Rise, October 18, 2026 (16:01 UTC), secondary source: Qubic network halted its mainnet after $1.3 million wallet raid hit 1,404 accounts; mainnet remained halted while the team assessed the incident; no confirmed timeline for resuming full operations
MABOnChain Daily Brief
The key crypto and markets stories in one short, plain-language email. Free. Unsubscribe any time.
Prefer chat? Join us on Telegram Watch on YouTube
Keep reading
Gitcoin (GTC) Jumps 13% to $0.25 as Upbit Listing and Techne Rebrand Momentum Holds
Gitcoin's GTC token climbed about 13% on October 18, 2026, leading Binance's top-volume gainers as momentum from Upbit's October 12 Korean won listing and the protocol's Techne rebrand held into a second week. GTC traded near $0.25 late Sunday after touching an intraday high near $0.29, with roughly $124 million in 24-hour turnover across exchanges, according to market data.
Thai Police Arrest Chinese Suspect in Bangkok Over Alleged $75M Laundering Network
Thai immigration police detained 37-year-old Chinese national Wu Chaoshuai at a luxury housing estate in Bangkok's Saphan Sung district on October 16, 2026. Chinese authorities had issued a warrant for him over an alleged transnational crime network that moved more than 500 million yuan through crypto and foreign-currency exchanges across more than 133 accounts. His Thai visa expired more than three years ago; Thailand plans to deport him to China after immigration proceedings.
Cysic Halts Cross-Chain Bridge After Attacker Mints 10 Million CYS on BNB Chain
Cysic suspended its cross-chain bridge after an attacker exploited a processing flaw to mint 10 million CYS on BNB Smart Chain on October 17, 2026. Preliminary findings point to unauthorized access to a database supporting the bridge; the recipient address was blacklisted about 76 minutes later with roughly 2.8 million CYS frozen in it. Cysic says no user wallets were touched and the mainnet was unaffected, and that the mint size alone does not establish the dollar loss, which is still under review.
Vitalik Buterin Builds 'Paranoid Mode' AI Agent Setup Using Tor, Cover Traffic and zkAPI
Ethereum co-founder Vitalik Buterin unveiled an experimental 'paranoid mode' for his pi AI agent harness that routes every conversation through a separate Tor circuit, masks requests with random cover traffic, pays for model access through the Ethereum-based zkAPI payment system, and rewrites every prompt locally before it reaches the provider. He says the setup is getting usable but still slow, and warns that Tor is a poor fit against a provider colluding with the network guard, calling instead for a specialized mixnet.
Bitget Names Russia, Belarus and Kazakhstan as Prohibited Jurisdictions, Bans 20 Sanctioned Platforms
Bitget's English Terms of Use, updated October 16, 2026, list Russia, Belarus and Kazakhstan among its prohibited jurisdictions, three days after the exchange said it would discontinue services for selected users in a one-off exercise. Separately, the exchange's Greater China arm said it will terminate accounts that transact with 20 sanctioned platforms, including BitPapa and NoOnecrypto, with a permanent no-re-registration rule for violators.
Nine Companies, Including Broadcom and Verizon, Formally Object to OKXICE Tokenized Share Trading
Nine U.S.-listed companies, including Broadcom, Verizon, CoreWeave and UnitedHealth, filed formal issuer objections in an October 15, 2026 OKXICE notice, using the SEC's issuer-objection mechanism to keep their shares off the 24/7 tokenized stock venue. Eight of the nine were among the 63 tickers OKXICE named on October 4; the venture says it still plans to launch with dozens of stocks including Nvidia and Apple.
EU and 8 Nations Sign Warsaw Protocol to Seize Criminal Crypto Across Borders
The European Union and eight countries signed the Additional Protocol to the Council of Europe's Warsaw Convention in Strasbourg on October 14, 2026, writing crypto-assets explicitly into the international framework for seizing criminal proceeds. The protocol lets authorities confiscate virtual assets urgently without prior notice, gives financial intelligence units power to suspend suspect crypto transactions, requires Asset Recovery and Asset Management Offices in signatory states, and needs five ratifications to enter into force.
US Shutdown Freezes SEC Review of 100-Plus Crypto ETF Filings as Solana, XRP and Cardano Launches Stall
The US government shutdown has frozen the SEC's review of more than 100 crypto ETF filings, stalling expected October launches for Solana, XRP and Cardano products. Decision deadlines on three XRP ETFs and Grayscale's Cardano ETF passed silently this week, and Bloomberg's Eric Balchunas says the October 6-10 Solana window that issuers had high conviction about is now threatened. CoinShares' James Butterfill says up to $60 billion in ETP inflows is still possible this year once Washington reopens.
South Korea Summons Five Exchanges to October 20 Tax Hearing as 22% Crypto Tax Looms
South Korea's government will convene representatives of Upbit, Bithumb, Coinone, Digital X and GOPAX, plus the DAXA industry body, on October 20 to hear industry views on a planned 22% tax on virtual asset transfer and lending income starting January 1, 2027. The tax, already postponed three times since 2020, would apply a 20% other-income tax plus 2% local surcharge after a 2.5 million won basic exemption, while lawmakers have filed rival bills to push it to 2029 and 2030.