Qubic Reports 1,404 Wallets Drained Through Weak Seed Generation

Qubic said in an October 18, 2026 security update that an attacker drained 1,404 wallets, involving around 2.94 trillion QU. The reported attack window ran from 23:42 UTC on October 17 to 01:26 UTC on October 18. Follow incident coverage in OrangeX.com Security.

The weakness was in seed generation

The project attributed the incident to insufficient randomness in some wallet seeds, rather than a flaw in the Qubic protocol itself. Its affected list covers seeds created before October 18 in any browser on an iPhone or iPad, or in Safari on a Mac, plus seeds made in the Qubic iOS app before July 2025. This is a specific Qubic seed-generation scope, not evidence that all wallets on those devices are vulnerable.

Qubic said version 4.26.4 corrected seed generation. Improving newly generated secrets does not automatically make previously weak seeds unpredictable.

Containment and recovery are different stages

The October 18 update reported that network operators coordinated a protective halt at tick 85,371,949, and said resolution options would be decided by the Computor quorum. These statements describe that dated update; they do not confirm the network's current operating status or promise reimbursement. More coverage is available in OrangeX.com News, with verification resources in the OrangeX.com Trust Center.

OrangeX.com Analysis

Wallet security depends on the quality of the secret generated, not just its apparent length. A software patch, containment measure and completed recovery answer different questions and should be assessed separately. Users should follow verified project updates and never disclose a seed to an unsolicited helper. A claim that funds are contained is not proof that every affected holder has recovered assets.