Qubic wallet seed-generation flaw hack — October 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | October 18, 2026 |
| Target type | Wallet software or provider |
| Loss | $1,300,000Price at time of incident |
| Recovered | $167,700 |
| Method | Private key compromiseSeeds for some Qubic wallets were generated with a random-number function not meant for secrets, so they were predictable enough for an attacker to rebuild and scan for funded wallets. The Qubic protocol itself was not at fault |
| Chains | Other |
| Outcome | Partially recovered |
What happened
An attacker drained 1,404 wallets on Qubic, a fee-less layer-1 blockchain, between 23:42 UTC on 17 October and 01:26 UTC on 18 October 2026, taking about 2.94 trillion QU, according to the project’s update on X. Press reports put the haul at about $1.3 million. At CoinGecko’s 17 October price it was about $1.44 million, the upper end here. Qubic traced the theft to weak randomness in how some wallets generated their seeds, not to the protocol: seeds created in any browser on an iPhone or iPad, in Safari on a Mac until 18 October 2026, or in older versions of the Qubic iOS app. CoinGape reported that the code used JavaScript’s Math.random() and that version 4.26.4 of the wallet switched to a cryptographic generator.
Qubic’s Computors, the fixed set of operators that run the network, halted the chain at tick 85,371,949. According to Qubic, 87.1% of the drained QU never left the network and is immobilised by the halt. The other 12.9% went to MEXC, which froze the receiving account within about an hour. MEXC and Bitget suspended QUBIC deposits and withdrawals. Qubic did not publish wallet addresses or transactions, so these figures could not be checked independently.
Recovered here is the 12.9% frozen at MEXC, about $167,700 at the headline value, following the registry’s rule that funds frozen by an exchange count as recovered. The 87.1% held by the halt is not counted yet: the Computors are to vote on what happens to it and on any restitution for the victims, and no restart date had been set by 21 October. Qubic has promised a technical report once recovery is settled.
Sources
- Qubic on X, security incident update (18 October 2026)Primary · retrieved 2026-10-21
- The Crypto Times (19 October 2026)Secondary · retrieved 2026-10-21
- CoinGape (19 October 2026)Secondary · retrieved 2026-10-21
- investingLive (19 October 2026)Secondary · retrieved 2026-10-21
- SlowMist HackedAggregator · retrieved 2026-10-21
Changes to this entry
- Recorded three days after the drain. Recovered counts only the 12.9% frozen at MEXC; the 87.1% held by the network halt will be added if the Computors return it.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Qubic wallet seed-generation flaw hack — October 2026", iTokenly, accessed 2026-10-21, https://itokenly.com/hacks/qubic-wallet-seeds-october-2026https://itokenly.com/hacks/qubic-wallet-seeds-october-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.