Qubic halts mainnet after weak wallet seeds let attacker drain 1,404 accounts

Qubic, the fee-less blockchain that pitches itself as infrastructure for AI workloads, has stopped its mainnet after an attacker drained 1,404 wallets of roughly $1.3 million worth of its QU token. According to the project's developers, as reported by Crypto Briefing, the problem was not a bug in the network itself but wallet seeds that were too predictable.

What went wrong

A seed is the secret from which a wallet's private keys are derived — whoever can reproduce it controls the funds. Qubic's team traced the drained wallets to seeds created on legacy Apple devices, Safari browsers and early iOS apps, which apparently produced weak randomness. An attacker who understood the pattern could recreate those seeds and sweep the balances one after another.

The team has released client version 4.26.4 to fix seed generation and says it moved other exposed funds to safety before they could be taken. Qubic's staking feature, QEARN, was not affected.

Where the money is now

About 87.1% of the stolen QU never left the Qubic network and is immobilised because the chain is stopped. The other 12.9% reached the exchange MEXC, which froze the receiving account within an hour on suspicion that it was linked to the attack.

Whether victims are reimbursed is up to Qubic's Computor cluster, the group of operators that runs the network and votes on its direction. Until then, affected users are being asked to file police reports. It is Qubic's second incident this year, after its Vottun Bridge was exploited in August.

What users can take from it

The lesson reaches beyond Qubic: a wallet is only as safe as the randomness used to create it. If you generated a seed with old software, consider moving funds to a freshly created wallet — ideally on dedicated hardware (see what a hardware wallet is and our guide to storing crypto safely). Watch next for the compensation vote, the restart on the patched client and when Bitget reopens transfers.