Qubic halts blockchain after $1.4 million wallet exploit

The Qubic layer-1 blockchain has halted its mainnet operations following a security exploit that drained approximately 2.94 trillion QU tokens, valued at roughly $1.3 to $1.4 million, from over 1,400 user wallets.

Developers traced the incident to a vulnerability in how certain wallet recovery seeds were generated, rather than a flaw in the blockchain's core code. The exploit targeted wallets created using specific software environments, including Safari on Mac, browsers on iPhone and iPad, and older versions of the Qubic iOS app. The issue stemmed from the use of the non-cryptographic JavaScript Math.random() function instead of the secure crypto.getRandomValues().

Validators paused the network at tick 85,371,949 to prevent further movement of assets. Approximately 87.1% of the stolen funds remain frozen on the Qubic network. The remaining 12.9% was transferred to the MEXC exchange, which froze the receiving account within an hour of the incident. Bitget also suspended QUBIC deposits and withdrawals as a precaution.

A fix has been released in web wallet version 4.26.4. The future of the stolen funds and the timeline for resuming network operations now depend on a decision by Qubic’s validators, known as Computors.