Qubic Halts Network After $1.3M Theft Hits 1,404 Wallets

Qubic theft totals 2.94 trillion QU

The strongest available loss count is Qubic’s own disclosure: 1,404 wallets and approximately 2.94 trillion QU moved during a 104-minute window. Wallets are addresses or accounts in this tally, not a verified count of individual people. One person can control several wallets.

The Defiant’s report, republished by Crypto News, calculated a value near $1.26 million using CoinGecko’s price at 15:03 UTC on October 18. The rounded $1.3 million headline describes the value of tokens taken, rather than demonstrated proceeds from sales or a final unrecoverable loss.

As of this article’s 00:06 UTC October 19 loss-impact check, Qubic’s containment update said 87.1% never left the network. It said the remaining 12.9% reached MEXC, which froze the receiving account within about an hour. Those percentages describe the same stolen-token pool and should not be added as separate losses.

MEXC’s own announcement confirms suspension of QUBIC deposits and withdrawals at the project’s request. That notice does not independently publish the receiving account’s balance or confirm completed restitution.

The public Qubic analytics dashboard also displayed tick 85,371,949 during the check, matching the halt point identified by the team. Its entity activity page showed transfers to MEXC during the incident window, but those entries alone do not prove which transfers belonged to the attacker.

The reviewed disclosure did not provide a complete victim-address and transaction-hash list that would allow this publication to independently reconstruct the entire theft. No separate, verified attack wave or additional loss total was established in the reviewed material.

Qubic flags Apple-created wallet seeds

Qubic’s affected-seed warning identifies three creation environments: any browser on an iPhone or iPad before October 18, 2026; Safari on a Mac before that date; and the Qubic iOS app before July 2025.

The relevant detail is where and when the seed was generated. Simply opening an existing wallet on an Apple device is different from creating its controlling secret there. The disclosure does not establish that unrelated Apple wallets or other cryptocurrencies share the weakness.

A wallet seed is the secret from which access to its funds is derived. Qubic’s official setup lesson describes its seed as a 55-character recovery key. A long secret can still be vulnerable if the process choosing its characters leaves too few possibilities for an attacker to test.

The project says version 4.26.4 corrects seed generation. That statement concerns creating secrets going forward. Installing an update does not retroactively replace the secret controlling an existing wallet, and the announcement should not be interpreted as repairing every previously generated seed.

The full technical report remains outstanding in the reviewed update. It should clarify the affected generation paths and the scope of exposure beyond the wallets already drained. The affected-environment list and observed victim count answer different questions: potential exposure and confirmed incident impact.

That distinction also limits what can be inferred from a wallet that still shows a balance. The reported tally counts wallets already emptied during the observed window; it is not a census of every secret created by the affected software. A network halt temporarily restricts movement without establishing that an old seed is unpredictable.

Qubic recovery rests with Computor quorum

Qubic says its Computors coordinated the protective halt. Stopping transactions can contain funds, but it also prevents unaffected holders from transferring their balances. Protocol operation and wallet security therefore have separate consequences in this incident.

Containment also differs from reversal. The earlier Tectonic rollback on Cronos illustrates how a recovery mechanism can change the final loss accounting. Qubic’s reviewed update announces a halt and an exchange-account freeze, without announcing an equivalent rollback or completed repayments.

In its recovery statement, the team said it was identifying affected identities and preparing options for the Computor quorum. A Discord poll was gathering community views. That consultation is not itself an adopted compensation plan.

Any recovery accounting will need to distinguish tokens held on the network, assets controlled through an exchange account and balances actually returned to victims. A percentage described as contained can be meaningful evidence of the response while still leaving ownership, release procedures and timing unresolved. Those are separate milestones for holders assessing the outcome.

Qubic asked affected holders to file police or cybercrime reports with their wallet ID, lost amount and explorer transaction link, saying formal reports help exchanges maintain freezes. It also warned against unsolicited recovery messages, seed requests and fee-based recovery offers.

Alternative.me displayed 59, classified as Greed, versus 53 previously when checked around 00:04 UTC. This Bitcoin-focused sentiment measure does not track Qubic’s recovery.

The next developments to watch are the quorum’s recovery decision, evidence of returned funds and an announced resumption of transactions. The reviewed disclosures do not settle the repayment terms, restart time or final unrecoverable loss.