Qubic has confirmed that an attacker drained 1,404 wallets, stealing round 2.94 trillion QU throughout a safety incident between October 17 and 18.
The community mentioned the issue got here from weak pockets seed era, not a flaw within the Qubic protocol itself.
Weak Pockets Seeds
In accordance with the replace, some pockets seeds had been created with inadequate randomness, making them simpler to compromise. The affected seeds had been generated on iPhones and iPads utilizing any browser earlier than October 18, on Macs utilizing Safari earlier than that date, or by means of the Qubic iOS app earlier than July 2025.
Qubic’s validators, referred to as Computors, coordinated a halt at tick 85,371,949 to stop additional motion of the stolen funds. With transactions paused, 87.1% of the drained funds stay on the community and frozen. The opposite 12.9% was despatched to MEXC, which froze the receiving account inside about an hour. Exchanges have additionally been notified and have suspended QUBIC deposits and withdrawals.
The staff asserted that the seed era concern has been mounted in model 4.26.4. No new weak seeds might be created beneath the corrected system. The following steps will rely on the Computor quorum, which can resolve how the incident is resolved beneath the community’s guidelines. The Core staff is figuring out affected identities and making ready choices for the quorum. A group ballot can also be open on Discord to collect suggestions.
The layer-1 blockchain community has urged affected customers to report the incident to native police or cybercrime authorities. Studies ought to embrace the pockets ID, the quantity misplaced, and the transaction hyperlink from the Qubic explorer.
September Nightmare
The Qubic incident comes after a expensive September for the crypto business. As reported by CryptoPotato, PeckShield counted 55 main crypto hacks in the course of the month, as losses reached virtually $766.5 million. That was round 462% larger than August’s $136.3 million.
Two incidents accounted for many of the injury. The Bitget breach concerned round $387 million, whereas the Liquid Community theft totaled roughly $320 million. Liquid later recovered $285 million. Bitget CEO Gracy Chen mentioned an attacker exploited a backend system to control transaction information and bypass authorization checks. The alternate plans to cowl the loss by means of its Consumer Safety Fund, which holds greater than $464 million.
The Liquid Community theft, alternatively, concerned roughly 4,000 BTC withdrawn from its federation pockets. The attacker promised to return the funds after community nodes had been patched, although Ledger CTO Charles Guillemet questioned whether or not the attacker was a authentic safety researcher.
The submit Qubic Pushes Again on Hack Claims: Weak Pockets Seeds Had been to Blame appeared first on CryptoPotato.