Qubic Halts Chain After $1.4M Seed Exploit

Qubic's blockchain ground to a halt on Sunday after an attacker exploited weak wallet seeds to drain roughly $1.4 million from more than 1,400 accounts.

The network paused at tick 85,371,949 and has not restarted. About 87% of the stolen tokens never left the chain, while the rest reached MEXC before the exchange froze the deposit address within an hour.

How the seeds broke

The vulnerability stemmed from using JavaScript's Math.random() to generate wallet seeds — a function never meant for cryptographic secrets. It affected seeds created in browsers on iPhone or iPad, Safari on Mac before October 18, and the Qubic iOS app before July 2025. The team has since swapped in crypto.getRandomValues() in wallet version 4.26.4, but the damage was already done.

What happens next

Qubic's Computors — the network's validator set — will vote on a recovery plan for the frozen funds. A full technical report is promised after the vote. No restart date has been announced, and the core team is still identifying every affected wallet.

Why this matters

Seed generation flaws keep surfacing across crypto, from Coldcard's firmware bug earlier this year to this Qubic incident. For users, the lesson is simple: verify how your wallet creates randomness, and move funds if the method is ever questioned. For builders, Math.random() should never touch a private key — the cost of cutting corners eventually gets paid in full. Qubic's $62 million market cap makes this a mid-sized project, but the pattern is universal: entropy failures don't discriminate by valuation.