The Qubic blockchain was halted on Sunday (18) after an attacker exploited a flaw in the generation of wallet credentials and diverted approximately US$1.4 million in cryptocurrency. According to the project team, more than 1,400 accounts were compromised, leading to the suspension of operations across the entire network.
The attack resulted in the diversion of about 2.94 trillion QU tokens. To prevent further movements, the participants responsible for validating the network halted its operation at tick 85,371,949, the unit used by Qubic to organize transaction processing.
The team reported that 87.1% of the diverted assets remain frozen on the blockchain. The other 12.9% were transferred to the MEXC exchange, which, according to the project, blocked the receiving account approximately one hour later.
Although the funds are blocked, that does not mean they have been recovered or returned to their owners.
The flaw was in wallet key generation
The vulnerability was in the mechanism used to create recovery seeds, secret sequences that allow the generation of wallet access keys. When these seeds are produced with insufficient randomness, an attacker may be able to reproduce them and gain control over the funds.
According to Qubic, the problem affected seeds generated in browsers on iPhones and iPads, in Safari on Mac computers, and in older versions of the iOS app. The flaw was in the wallet software, not in the blockchain's consensus mechanism.
The history of the official GitHub repository confirms that version 4.26.4 of the web wallet, released on October 18, replaced the Math.random() function with crypto.getRandomValues() in seed generation. Unlike the former, the new function uses a random number generator suitable for cryptographic operations.
The update fixes the generation of new credentials, but does not automatically make previously created vulnerable seeds secure.
The Qubic team is working on identifying the affected wallets and preparing alternatives for asset recovery. The proposals will be submitted to a vote by the Computors, the participants responsible for the network's operational decisions.
As of the release of the information on October 19, there was no announced date for resuming operations. The project also promised to publish a complete technical report after the recovery plan is defined.
