Qubic Loses $1.3M as Wallet Raid Exploits Apple Seed Flaw

An attacker drained 1,404 Qubic wallets in under two hours on the night of October 17⁠–⁠18, stealing roughly 2.94 trillion QU tokens worth $1.3 million. The raid ran from 11:42 PM to 1:26 AM ET.

Details

The attacker did not exploit a vulnerability in the Qubic blockchain itself. Instead, they reconstructed wallet seeds generated by Apple software — specifically wallets created through browsers on iPhones and iPads, Safari on Mac, and older versions of the Qubic iOS app, which used a predictable seed-generation algorithm. According to Bitcoin.com, the network was halted at tick 85,371,949 when validators intervened to freeze the stolen funds.

As a result of the intervention, 87.1% of the stolen tokens remain frozen on the Qubic network. The remaining 12.9% reached exchange MEXC, which promptly froze the receiving account. Bitget suspended all QUBIC deposits and withdrawals, citing maintenance. The decision on user restitution now lies with Qubic's Computor quorum — the network's validator council. The team has released app version 4.26.4 to patch the seed-generation flaw.

What This Means for the Market

The incident is a reminder that crypto users are often more exposed through wallet software and mobile apps than through blockchain-level attacks. The on-chain freeze recovering 87% of funds is an unusually positive outcome in such scenarios. Qubic was founded by Sergey Ivancheglo ("Come-from-Beyond"), an early contributor to NXT and IOTA; the project drew controversy in 2025 after seizing majority control of Monero's mining hash rate.

For live Bitcoin price and market data, see CoinLab.

Full timeline — in our article.