Qubic Hits Pause, Math.random Gets an F: $1.4M Vanishes in 104 Minutes of Wallet Whack-a-Mole 🧮

Layer-1 blockchain network Qubic halted operations on October 18, 2026, after an attacker drained approximately 2.94 trillion QU, worth about $1.4 million, from 1,404 wallets over roughly 104 minutes. According to the project, validators known as Computors stopped the chain at tick 85,371,949, where it remains paused.

The root cause was not a protocol bug but a weak random number generator in the wallet's seed creation layer. The attacker exploited JavaScript's Math.random(), which is not designed for cryptographic secrets, to reconstruct wallet seeds without brute force. Affected wallets were those generated in any browser on iPhone or iPad, in Safari on Mac prior to October 18, 2026, or in the Qubic iOS app before July 2025.

Qubic said in a statement on X that "87.1% of the drained funds never left the Qubic network and remain frozen in place," with the remaining 12.9% sent to MEXC, whose team froze the receiving account within about an hour. A GitHub commit for version 4.26.4 shows Qubic replaced Math.random() with the cryptographically secure crypto.getRandomValues() function when creating wallet seeds.

The Qubic incident follows a series of attacks tied to weak wallet seeds. In July, Coldcard disclosed that attackers had stolen funds from wallets whose seeds were weakened by a firmware bug, while similar flaws affected Trust Wallet's browser extension and the Libbitcoin Explorer tool in 2023. Separately, Bitget's $388 million hack helped push third-quarter crypto security losses past $1 billion, according to AMLBot's 2026 investigations report, which examined 250 investigations opened since the start of the year. Hacks and exploits accounted for 19% of crypto crime cases but 40% of reported losses during the quarter.

Qubic said its core team is identifying affected wallets and preparing recovery options for a vote by the network's Computors, which will decide what happens to the frozen funds. The team said it would publish a full technical report after a recovery plan is settled, and has not announced when the network will restart. Qubic, a layer-1 blockchain supporting fee-less transactions and smart contracts built on Useful Proof of Work (UPoW), had a market capitalization of about $62.6 million at the time of writing, according to CoinGecko. Qubic did not immediately respond to a request for comment.