Qubic hack: $1.3M stolen via Apple seed flaw — full timeline

On the night of October 17⁠–⁠18, 2026, an attacker drained 1,404 Qubic wallets in under two hours, stealing roughly 2.94 trillion QU tokens worth $1.3 million. Qubic validators acted quickly to freeze 87.1% of the stolen funds on-chain; the remaining 12.9% were immediately locked by exchange MEXC.

What We Know Now

• Stolen amount: approximately 2.94 trillion QU (~$1.3 million at time of attack); 1,404 wallets affected.
• Funds frozen: 87.1% of stolen tokens are blocked at the network level — validators (Computors) halted transactions; 12.9% reached MEXC, where the attacker's account was immediately frozen.
• Compensation: a decision on victim restitution is pending from the Qubic Computor quorum; no vote has been announced yet.
• Patch released: the Qubic team has released app version 4.26.4 fixing the seed generation algorithm; developers also proactively secured additional vulnerable funds before the attacker could reach them.
• Staking unaffected: the QEARN staking service continued operating normally throughout the incident.

How It Happened

The vulnerability was not in the Qubic blockchain itself — it was in Apple's software. Qubic wallets use 55-character seed phrases for access recovery. When a seed was generated through a browser on iPhone or iPad, through Safari on Mac, or through older versions of the Qubic iOS app, the process used an insufficiently random entropy source — a quirk of Apple's pseudo-random number generator implementation.

The attacker precomputed a small collection of predictable seeds that could have been generated on such devices. By systematically checking those seeds, they identified 1,404 wallets with real balances and drained them in under two hours. Wallets created on other platforms or in updated apps were not at risk.

Timeline

October 17, 11:42 PM ET (03:42 UTC Oct 18). The attack begins: the attacker starts cycling through precomputed seeds and withdrawing funds from vulnerable wallets.

October 18, 1:26 AM ET (05:26 UTC). The attack ends. In under two hours, roughly 2.94 trillion QU is stolen from 1,404 wallets.

October 18, early morning ET. Qubic validators (Computors) detect the anomaly. Transactions are frozen at tick 85,371,949. 87.1% of stolen tokens are immobilized on-chain.

October 18, early morning ET. MEXC freezes the account that received the remaining 12.9% of stolen tokens. Bitget suspends all QUBIC deposits and withdrawals, citing maintenance.

October 18, daytime ET. The Qubic team releases app version 4.26.4 with a corrected seed generator. Developers also proactively secure additional vulnerable funds before the attacker can reach them. The decision on victim compensation is referred to the Computor quorum.

Where the Funds Went

Of the 2.94 trillion QU stolen, 87.1% remain frozen directly on the Qubic network due to the emergency transaction halt. The remaining 12.9% — roughly 379 billion QU — reached MEXC, where the attacker's account was immediately locked. As of October 18, 100% of stolen funds remain inaccessible to the attacker.

What the Team and Exchanges Did

The Qubic team issued patch 4.26.4 and proactively moved vulnerable funds to safety before the attacker could reach them. The decision on compensating affected users has been referred to the Computor quorum — a council of Qubic's 676 network validators.

MEXC immediately froze the attacker's account. Bitget suspended QUBIC trading. The QEARN staking service continued operating without disruption.

What This Means for Holders

The hack did not affect the Qubic blockchain protocol itself — the vulnerability was in peripheral software. Wallets created outside Apple devices, or in updated versions of the Qubic app, are safe. Affected users should update to version 4.26.4 and wait for the Computor quorum's decision on restitution.

The incident is another reminder that crypto users are often most exposed through wallet software, browser apps, and mobile clients — not through the blockchain itself. The on-chain freeze recovering 87% of stolen funds is an unusually positive outcome for this type of attack.

This is not investment advice.

---

This story is developing: we are monitoring the situation and will add new information as it becomes available. Last updated October 18, 2026, 10:10 AM ET.