Carteira Qubic · Breach

Qubic Back Online, Opens Recovery Claims After Seed Flaw Drained 1,404 Wallets

Oct 16, 2026 · 1 min read

Attackers exploited weak randomness in Qubic wallet seed generation and drained about 2.94 trillion QU from 1,404 wallets, worth roughly $1.3 million to $1.4 million, according to SlowMist and Crowdfund Insider. Validators halted the network to contain the stolen assets and it resumed on October 19, 2026; Qubic approved the recovery plan, returned the first funds, and accepts claims through May 1, 2027. Wallet version 4.26.4 fixes generation for new seeds only.

By HIFY Radar newsroom Updated 10/26/2026 01:25 PM Get this every day →← Back to the feed 6 sources

HighBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Attackers drained about 2.94 trillion QU from 1,404 Qubic wallets, worth between $1.3 million and $1.4 million, by exploiting weak randomness in wallet seed generation. Validators halted the network to contain the stolen assets and it resumed on October 19, 2026. Qubic approved the recovery plan and has already returned the first funds to verified owners.

Why it matters

The issue affects anyone who created seeds in iPhone and iPad browsers, in Mac Safari before October 18, 2026, or in the iOS app before July 2025. The fix in version 4.26.4 applies to new seeds only, so old wallets remain exposed. Of the stolen funds, 87.1% are frozen onchain and 12.9% were blocked by the MEXC exchange.

What to do

Create a new identity with wallet 4.26.4 or later and move assets to it. File a claim on the Qubic recovery portal by May 1, 2027, with ownership evidence such as pre-incident exchange withdrawal receipts. A signature from the compromised wallet alone does not prove ownership.

For the technical team

Affected: Carteira Qubic (web e iOS) · Qubic wallet (web and iOS). Seeds created in iPhone and iPad browsers, in Mac Safari before October 18, 2026, and in the iOS app before July 2025. The blockchain protocol was not compromised; the flaw is in wallet seed generation.
Exploitation: Confirmed exploitation, with a SlowMist postmortem published October 20, 2026. The attacker drained wallets between 23:42 UTC on October 17 and 01:26 UTC on October 18. About 87.1% of the stolen QU remains frozen onchain; 12.9% reached MEXC, which froze the receiving account about an hour after the deposit.
Fix: Qubic wallet 4.26.4, which uses cryptographically secure randomness; the fix applies to new seed generation only. Existing seeds created under the affected conditions must be replaced with a new identity generated in 4.26.4 or later.
Vector: The web wallet built each 55-character seed with JavaScript's Math.random, without mixing in the user's password, a device key, or any other randomness source; V8's xorshift128+ generator allows at most 2^64 outcomes per call, though the format implies about 258 bits of strength. The same random stream produced a dejaVu value written into network request headers, forwarded to peers over plaintext TCP. According to SlowMist, six consecutive dejaVu values were enough to reconstruct the generator's full 128-bit state in about 15 milliseconds, letting an observer predict seeds and verify them against public keys sent in balance requests.
More details: Computors (validators) halted the network at tick 85,371,949; processing resumed at 20:00 UTC on October 19, 2026. The Computor quorum approved the recovery plan on October 20 and the first funds were returned to verified owners; the portal collects and verifies claims while the quorum decides and applies recoveries, with the window open through May 1, 2027. Since anyone holding a weak seed can produce a valid wallet signature, a signature alone does not establish ownership.