Qubic Hack

Between October 17 and October 18, 2026, Layer-1 network Qubic experienced a wallet seed generation exploit resulting in approximately 2.94 trillion QU (~$1.3M – $1.4M USD) being drained across 1,404 accounts. The issue stemmed from weak pseudo-random number generation (Math.random()) in the front-end wallet seed creation layer rather than a core blockchain protocol flaw.

The incident occurred due to insufficient entropy/randomness during wallet seed creation across specific environments, specifically seeds generated using Math.random() on iOS/iPadOS browsers, Safari on macOS (prior to October 18, 2026), and early versions of the Qubic iOS app (prior to July 2025). An attacker brute-forced the predictable seed derivations and systematically drained 1,404 affected wallets between 23:42 UTC on Oct 17 and 01:26 UTC on Oct 18. In response, network operators (Computors) coordinated a protective network halt at tick 85,371,949.

As a result of the halt, 87.1% of the drained tokens remained immobilized on-chain, while the remaining 12.9% sent to CEX platform MEXC was frozen by the exchange. The core team deployed version 4.26.4 replacing Math.random() with cryptographically secure randomness (crypto.getRandomValues()).