Hacker steals $1.3M from Qubic wallets through a seed phrase flaw on Apple devices

Key points:

• A hacker drained 2.94 trillion QUBIC (about $1.3M) from 1,404 wallets on the Qubic blockchain.
• He exploited the fact that seed phrases on Apple devices were generated with insufficient randomness and could be predicted.
• The network has been halted: 87.1% of the funds are frozen on-chain, and MEXC blocked the remaining 12.9%.

The attack began on October 17 at 23:42 UTC. Over the next 104 minutes, the attacker emptied 1,404 wallets on the Qubic network. By 01:26 UTC on October 18, he had gathered 2,939,606,531,944 QUBIC, about $1.3M at the time, across seven addresses. The project team reported the incident.

The blockchain itself was not breached. The hacker did not brute-force every possible key. Instead, he rebuilt a narrow set of predictable seed phrases and checked which of them held funds.

Why Qubic seed phrases on Apple devices turned out to be predictable

In Qubic, a seed phrase is a 55-character string from which the wallet keys are derived. To make it impossible to guess, the generator has to draw on truly random data. On some Apple devices that did not happen: the wallet code relied on the Math.random() function, which is not fit for cryptography.

• Seed phrases created in any browser on an iPhone or iPad before October 18, 2026.
• Seed phrases created in Safari on a Mac before October 18, 2026.
• Seed phrases created in the Qubic iOS app before July 2025.

Not every wallet in these groups was drained, but the developers still consider the untouched ones vulnerable. On October 18, the team released wallet version 4.26.4, which replaces Math.random() with crypto.getRandomValues(). The update protects only new seed phrases – old ones remain at risk.

How Qubic halted the network and froze the stolen QUBIC

Qubic validators, known on the network as Computors, made an emergency halt of the blockchain at tick 85,371,949. Transactions stopped going through, and the hacker could no longer move the loot. Meanwhile, the developers moved funds from other vulnerable wallets to safety before the attacker could reach them.

87.1% of the stolen QUBIC never left the network and are frozen on-chain. The hacker managed to send the remaining 12.9% to MEXC, and the exchange froze the receiving account within an hour.

MEXC and Bitget suspended QUBIC deposits and withdrawals. MEXC clarified that it did so at the request of the project team. The attack did not affect QEARN staking. By the morning of October 18, the QUBIC price had dropped by more than 10%.

Will Qubic return funds to owners of the hacked wallets

No compensation decision has been made yet. The Computor quorum will decide what happens to the frozen funds. Meanwhile, the project team is identifying all affected addresses and preparing options.

Frozen does not mean returned, – Qubic warned.

The developers have not named a date for the network restart. They promised to publish a detailed technical report once they settle on a recovery approach.

• File a police report if your wallet was drained.
• Once the network restarts, create a new wallet in version 4.26.4 and move your remaining funds there.
• Ignore offers to “help recover funds” and never share your seed phrase with anyone.