Qubic Chain Halted After $1.4 M Stolen from 1,400+ Wallets via Weak Seed
Current overview (not historical)
Qubic’s blockchain was frozen at tick 85,371,949 after an attacker exploited weakly generated wallet seeds to drain roughly $1.4 million from more than 1,400 accounts. About 87.1% of the stolen funds remain locked within the Qubic network, while the remaining 12.9% was transferred to MEXC, whose team froze the receiving account within an hour. The incident exposed a vulnerability in Qubic’s seed generation, which used Math.random(). The project has since patched the flaw in version 4.26.4 by replacing Math.random() with crypto.getRandomValues(), restoring the integrity of wallet creation.
Written with AI from the reporting · updated 10/19/2026
Expand the detailed fact route and sources
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Unclassified fact stationOct 19, 00:00recorded Oct 19, 09:34single sourcerevised
Qubic chain frozen after attacker drains 1.4K wallets with w
Read original source ↗ CointelegraphReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- Qubic
- Action：
- halted operations
- Object：
- network at tick 85,371,949
- Occurred (fact side)：
- Oct 19, 00:00
- Published (valid side)：
- Oct 19, 09:03
- First seen (known side)：
- Oct 19, 09:34
Fact stationSingle source · one-sided claimRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
Uncertainty marks flag where to check the sources; they are not proven causation.
Report timeline
Explore every side through dated source reports.
- CointelegraphRelated fact: single sourceSource report revisedQubic halts blockchain after attacker drains $1.4M from 1,400 wallets via weak seeds
Report first recorded Oct 19, 09:34
Qubic paused its layer-1 blockchain at tick 85,371,949 after an attacker exploited weak wallet seeds generated on iOS Safari and the Qubic iOS app, draining approximately $1.4 million from over 1,400 accounts. About 87.1% of the stolen funds remain frozen on the network, while the remaining 12.9% was sent to MEXC, whose team froze the account within an hour. The project has since fixed the seed-generation flaw in version 4.26.4 by replacing Math.random() with crypto.getRandomValues().
Read original source ↗
Event discussion
Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.