QUBIC BLOG POST
Qubic Wallet Drain: How the Quorum Stopped a Crypto Hacker’s Plan Within Hours.
Written by
The Qubic Team
Published:
Listen to this blog post
On the morning of October 18th, some Qubic holders opened their wallets and found them empty. QU they had earned, mined and held on to through good weeks and bad was gone overnight. An attacker had drained 1,404 wallets in less than two hours.
Qubic’s response began within minutes. By the time most victims saw their balances, the network had already stopped. The Computors had called an emergency halt, 87.1% of the stolen QU was frozen where it sat, and MEXC had frozen the account where the attacker sent the rest. Two days later, the quorum approved a recovery plan and the network came back online. A drain this size could have kept another network offline for weeks or split its chain in two. For Qubic, it meant one controlled emergency halt, with the quorum acting in holders’ interest at every step. Now exchanges are reopening, and the first stolen funds are already back with their owners.
This is the story of that crypto hack, and of how Qubic’s quorum, its technology, its exchange partners and its community worked together to protect holders and return what the attacker took.
The Qubic Wallet Drain at a Glance
What happened: between 23:42 UTC on October 17 and 01:26 UTC on October 18, 2026, an attacker drained about 2.94 trillion QU from 1,404 Qubic wallets (around $1.4 million in press estimates).
Why it happened: some wallet seeds had been generated with too little randomness, so the attacker could reproduce them. The Qubic protocol and its consensus were never compromised, and every transfer was an ordinary signed transaction.
How it was contained: the Computors coordinated a protective halt at tick 85,371,949, which kept 87.1% of the drained funds on the network. MEXC froze the attacker’s account on its platform and has since returned the frozen funds to Qubic.
How fast: the wallet fix shipped on October 19th. The quorum approved recovery and the network resumed on October 20th.
What's next: the official reclaim portal is open until May 1, 2027, and the first funds have already gone back to verified owners.
What Happened? A Crypto Hack That Never Touched the Blockchain
Most crypto hacks people read about break something: a smart contract, a bridge, an exchange's hot wallet. This one didn't need to. The attacker held the same keys as the owners, so each transfer looked exactly like a normal payment which had been signed and validated.
The weakness sat one step earlier, in how some wallets created their seeds. In Qubic, the seed is the single secret behind an identity. A seed only protects you if it is truly unpredictable. Some seeds created on certain device and browser combinations were not random enough, and that gave the attacker a way to reproduce them.
Within about 104 minutes the attacker had swept liquid QU from 1,404 identities into a handful of collector wallets. Here is where the money went:
87.1% (about 2.56 trillion QU) never left the Qubic network. It sat on eight attacker-controlled wallets, where the network halt froze it.
12.9% (about 379.04 billion QU) went to a single MEXC deposit address in two transactions. MEXC froze the attacker’s account at about 01:52 UTC, roughly an hour after the deposits landed, and has since returned the frozen funds to Qubic.
Which Qubic Wallets Were Affected?
All of the affected seeds were created on Apple devices. Seeds were affected if they were created:
on an iPhone or iPad, in any browser (Safari, Chrome, Firefox and others), before October 18, 2026
on a Mac using Safari, before October 18, 2026
in the Qubic iOS app, before July 2025
Android app wallets were checked and are safe.
How Secure Seed Generation Protects Your Crypto Wallet
A wallet is only as strong as the randomness behind its keys. Browsers ship a general-purpose random number function and a separate cryptographic one, and the difference matters. Mozilla's developer documentation is blunt about the general-purpose one: it "does not provide cryptographically secure random numbers," and should never be used for anything related to security. The secure option is the Web Crypto API's random generator.
This is a known challenge across the industry. In 2023, the Milk Sad disclosure showed how weak entropy in the Libbitcoin Explorer tool let attackers recreate wallet keys and empty them. Attacks on individual users are growing too. Chainalysis found that personal wallet compromises made up 23.35% of all stolen-fund activity in the first half of 2025.
What sets this incident apart is what happened next.
How Fast Did Qubic Respond? The Incident Response Timeline
Speed decided everything here. Once stolen crypto reaches an exchange and gets swapped or withdrawn, it is very hard to get back. Qubic’s response started closing those exits within minutes.
Date and time (UTC) | What happened |
|---|---|
October 17th, 23:42 to October 18th, 01:26 | Attacker drained about 2.94 trillion QU from 1,404 Qubic wallets |
October 18th, about 01:52 | MEXC freezes the attacker’s account, about an hour after the deposits |
October 18th | Computors coordinate a protective halt at tick 85,371,949. No further transactions are processed |
October 18th | Every exchange listing QUBIC is notified within 20 to 30 minutes and suspends deposits and withdrawals |
October 18th | Qubic publishes its first incident updates, with the affected device list, where the funds are and a scam warning |
October 18th, within about 10 hours of the attack | Developers reproduce the attack and identify every affected seed, plus a few hundred weak seeds not yet exploited |
October 19th | Web wallet 4.26.4 is released and no new weak seeds can be created |
October 20th | Computor quorum approves the recovery, the network resumes and the reclaim portal opens |
October 21st to October 22nd | SafeTrade and XT.com reopen QUBIC deposits and withdrawals |
October 24th | Return of the frozen funds held at MEXC is announced |
Week of October 26th | More than 230 claims received, the first returns go out |
October 29th | MEXC reopens QUBIC withdrawals, with deposits resuming at 14:00 UTC |
October 31st | Gate.io reopens QUBIC deposits and withdrawals |
How Qubic and Its Exchange Partners Locked Down the Stolen Funds
A network that keeps running after a drain gives the attacker time to sell, bridge or launder. Qubic moved to take that time away, and its exchange partners moved with it.
A Protective Halt at an Exact Tick
Qubic's 676 Computors process transactions tick by tick and agree on each one through a quorum. That design gave the network a clean way to act. The Computors coordinated a halt at tick 85,371,949, and from that moment not a single QU could move. The attacker's eight wallets were frozen with the stolen funds still in them.
MEXC and Exchange Partners Stepped In
Every exchange listing QUBIC was alerted within 20 to 30 minutes of the alarm being raised, and MEXC acted fast. Its risk team froze the attacker’s account about an hour after the deposits arrived, suspended QUBIC deposits and withdrawals at Qubic’s request and kept the freeze in place while the investigation ran. Qubic shared a full incident report with every transaction ID and all nine attacker addresses, and MEXC worked closely with the team from the first hour through to returning the frozen funds. That kind of partnership is what gives users a real chance of getting stolen crypto back, and it played a big part in this recovery. Other exchanges paused QUBIC services too, so nothing could move quietly while the network was secured.
Finding Every Weak Seed Before Anyone Else Could
Freezing the drained wallets was only half the job. If more weak seeds existed, they were exposed too. The developers reproduced the attack, then put a large computing cluster to work scanning for every weak seed on the network. About 10 hours after the drain, they had found every affected seed and a few hundred more weak identities the attacker had not touched yet. Those were frozen as well, before anyone could empty them.
Why the Computor Quorum Could Recover Funds Without Splitting the Chain
Freezing the stolen funds was one thing. Giving the money back was much harder, because any change to balances has to be agreed by the whole network.
This is where blockchain safety depends on more than cryptography. It depends on how a network makes decisions under pressure. On Qubic, that agreement comes from the quorum. Network decisions need at least 451 of the 676 Computors, a two-thirds-plus-one threshold built for Byzantine fault tolerance. With the network halted, the quorum could choose which state to resume from. The Core team analysed the incident, identified every affected identity and laid out two options:
Resume in a recovered state. The QU held by the attacker identities, frozen at the halt, moves to a recovery identity controlled by core developers. From there it goes back to affected users through a verified claims process.
Resume as-is. The ledger picks up unchanged from the halt, and the attacker keeps the drained QU.
The team was open about the trade-off. A recovered state means balances change from where the halt left them, and some would see that as a precedent. Resuming as-is would have meant letting the attacker keep what was taken from holders. Before the vote, the community ran a poll so the Computors had a clear read of where holders stood. The poll was a recommendation, and the binding decision belonged to the Computors.
Even in the middle of an emergency, the decision went through the quorum and not a back room. The Computors chose the option that put holders first and approved recovery two days after the attack. The update they voted on was narrow by design:
It moves only the drained QU from the listed attacker identities, plus the funds of identities found to be at risk, into a secured escrow identity.
It freezes every affected identity as a protective measure, not a penalty.
It cancels open QX orders on frozen identities so the assets tied up in them are secured too.
Every movement in and out of the escrow identity is on-chain and public.
It is not a general power. Any future case would need its own quorum decision.
Because the change shipped as one agreed state in one release, the Computors never risked splitting into two competing chains. Compare that with Ethereum's response to the 2016 DAO attack. Its recovery came through a hard fork on July 20, 2016 and part of the community refused it and kept running the original chain, which became Ethereum Classic. Qubic's governance let the network reach a single answer, apply it and restart all within two days.
Centralized exchanges handle this kind of loss differently. When attackers took about $6.3 billion from Binance on October 29, the exchange pledged to cover all user losses from its own funds, the right move for a large custodian with a balance sheet to stand behind its customers. A decentralized network has no balance sheet. When self-custody wallets are drained, there is no company treasury to refill them, so protection has to come from the protocol itself. On Qubic, that protection came from the quorum, which secured every drained QU still on the network and gave holders a clear path to getting it back.
What Qubic's Technology Protected
The attacker only moved plain QU transfers. Everything locked inside Qubic's smart contracts stayed where it was, and the network's design did a lot of the recovery work:
QEARN held firm. The QEARN staking contract was not touched. Community analysis found its locked principal actually grew during the incident, and almost all of the QEARN held by affected users stayed locked.
Tokens, shares and QX positions were not taken. Only liquid QU was swept.
An exact snapshot. Because the halt happened at one precise tick, every balance at that moment is on record. Claim amounts come straight from that snapshot, so nobody has to guess what they lost.
The escrow is fully visible. Anyone can follow the recovered funds on the Qubic Explorer.
How to Recover Stolen Crypto: Qubic's Reclaim Process
The official portal is weak-seed-reclaim.qubic.org, and it is the only official reclaim site. Anyone can use the address checker to see whether an identity is on the affected list with no signature or evidence needed.
To file a claim:
Enter the affected identity and a brand-new destination identity, created with a secure seed in an updated wallet.
Sign the message shown, inside your wallet. You never paste or upload a seed.
Upload evidence of ownership and a contact email.
Save your status link to track the claim. No account is needed.
Optionally, complete a Didit identity check to speed up approval. Qubic receives only a pass or fail result, never your documents.
Why a Signature Alone Isn't Enough
Because these seeds were weak, the attacker holds the same key as the owner and can produce the same valid signature. So ownership is proven with evidence the attacker can't have. Roughly in order of strength:
exchange withdrawal receipts to the affected address
OTC deal confirmations that reference the address
a pre-incident funding trail from an address you control
a signed message from an unaffected address that funded the affected one
personal or sworn statements, as supporting evidence only
When Claims Are Paid
The first returns went out in the week of October 26 for cases where ownership was beyond doubt. Examples include identities posted publicly with a signature before the incident, OTC trades a counterparty can confirm, and community project funds whose ownership is widely known. The rest are paid at checkpoints:
Checkpoint | Approximate date | Who is paid |
|---|---|---|
2 months | December 2026 | Strong evidence, uncontested |
4 months | February 2027 | Strong evidence, uncontested |
6 months | April 2027 | All remaining valid claims |
The frozen funds from MEXC are covered too. MEXC has already returned them to their original, frozen address on Qubic, and they are now part of the same claims process. Qubic has also said that if any funds end up missing, it expects the gap to be closed through a community contribution. The goal is simple: every affected user made whole.
Is Your Qubic Wallet Safe? How to Secure Your Crypto Wallet Now
After the incident, the developers scanned every wallet type. Here is what holders should do:
If you created a web wallet before version 4.26.4 (released October 19th), treat it as insecure, even if your funds were never touched. Update to 4.26.4 or later at wallet.qubic.org, create a new wallet with a fresh seed and move your funds to it.
If you use the iOS app or the web wallet on iOS, create a new wallet too, even if your address was not on the affected list.
If you use the Android app, your wallet was not flagged and is safe. No new app updates were needed on either store.
If your identity was frozen, your QU and assets are safe in escrow. Claim them through the portal, and never use the weak seed again.
If you lost funds, file a police or cybercrime report in your country, such as the FBI's IC3 in the United States. Include your wallet ID, the amount lost and the transaction link from the explorer. Exchanges often need formal police reports before they can keep stolen funds frozen, so every report helps.
For good seed phrase security in general, keep your wallet on a device you trust, ideally one you don't use for everyday browsing. Our guide on how to secure your Qubic wallet covers the basics.
Scam Alert! Recovery events attract impersonators. Nobody from the Qubic team will ever DM you first, ask for your seed or charge a recovery fee. Help is available in the dedicated Discord channel, staffed by moderators. Qubic doesn't run a ticket system, so anyone offering you a "support ticket" is not from Qubic.
Is Qubic Safe? What This Incident Showed
The incident tested every layer of Qubic, and the core held. The protocol was never breached, consensus never faltered and no transaction was forged. The weakness sat in one step of the wallet software. It was fixed in a new release the next day, and every wallet type has been checked since.
What the incident showed most clearly is whose side the network is on. Every decision the quorum made had the same aim: keeping holders’ funds safe and getting them back to their rightful owners. The halt protected funds that had not moved yet. The freeze protected wallets the attacker had not reached. The recovery vote gave the stolen QU a path home, with a narrow mandate and every movement on-chain for anyone to check. And the claims process is built so that the owner, not the attacker, is the one who gets paid.
Where the Qubic Network Stands Now
The Qubic network has been live since October 20th and is processing ticks normally. It is running on the same architecture that CertiK certified at 15.52 million transactions per second on mainnet. Trading is coming back too:
SafeTrade reopened QUBIC on October 21st and XT.com on October 22nd.
MEXC reopened withdrawals, and deposits resumed on October 29th.
Gate.io reopened on October 31st.
Bitget and a few other platforms are expected to follow, with no dates confirmed yet.
The team has held back some technical specifics on purpose, so that the details cannot be used by attackers. A full technical report will follow once recovery is settled.
Frequently Asked Questions
Was the Qubic blockchain hacked?
No. The Qubic protocol and its consensus were not compromised, and no transaction was forged. An attacker reproduced weak wallet seeds created on certain Apple devices and browsers, then moved funds with ordinary signed transfers. The network halt, the quorum vote and the restart all worked as designed.
Is my Qubic wallet safe?
If you created a web wallet before version 4.26.4, or used the iOS app or the web wallet on iOS, create a new wallet and move your funds, even if nothing was taken. Android app wallets were not flagged. You can check whether an identity is on the affected list at weak-seed-reclaim.qubic.org.
How do I get my stolen QU back?
File a claim at weak-seed-reclaim.qubic.org before May 1, 2027. You'll need the affected identity, a new secure destination identity, a signed message from your wallet and evidence of ownership. Stronger evidence gets paid sooner.
Did QEARN lose any funds?
No. The attacker only swept liquid QU. The QEARN staking contract stayed intact, and nearly all affected users' QEARN positions remained locked. QEARN balances belonging to frozen identities are returned in later batches after the main claim period.
What happened to the funds frozen at MEXC?
MEXC froze the attacker’s account about an hour after the deposits arrived and kept the freeze in place throughout. MEXC has since returned the frozen funds to their original, frozen address on Qubic, and they will go back to their owners through the same claims process.