Qubic halts mainnet after attacker drains 1,404 wallets of $1.3 million

Decentralized AI network Qubic paused its mainnet on October 18, 2026, after an attacker drained 1,404 wallets of 2.94 trillion QU tokens worth $1.3 million. The breach stemmed from predictable wallet seeds generated on legacy Apple devices and Safari browsers. About 87.1% of stolen funds remain immobilized on-chain, while exchange MEXC froze the remaining 12.9%. Qubic released client version 4.26.4 to patch the vulnerability, while its Computor cluster evaluates victim compensation.

Mainnet halt and restart preparations

• ▪Qubic network validators halted mainnet operations at tick 85,371,949 to lock the ledger in place following the October 18, 2026 Qubic wallet drain
• ▪Qubic developers prepared for a mainnet restart utilizing the patched client version 4.26.4 following the October 18, 2026 wallet drain

Scope and timing of the attack

• ▪Decentralized AI computing network Qubic halted its mainnet on October 18, 2026, after an attacker drained 1,404 user wallets
• ▪The Qubic wallet drain on October 18, 2026 lasted 104 minutes, running from 23:42 UTC on October 17, 2026, to 01:26 UTC on October 18, 2026
• ▪The October 18, 2026 Qubic wallet drain resulted in the theft of approximately 2.94 trillion native QU tokens valued at roughly $1.3 million
• ▪The October 18, 2026 Qubic wallet drain did not affect QEARN, the Qubic network's staking feature

Root cause and software fix

• ▪Qubic developers stated that the October 18, 2026 wallet drain stemmed from weak, predictable wallet seeds created on legacy Apple devices, Safari browsers, and early iOS applications rather than a core network code bug
• ▪Qubic developers released client version 4.26.4 to fix the October 18, 2026 seed-generation vulnerability and secured additional funds also exposed to that vulnerability prior to theft

Exchange actions and asset tracking

• ▪Approximately 87.1% of the QU tokens drained in the October 18, 2026 wallet drain remain immobilized directly on the Qubic network on-chain
• ▪Cryptocurrency exchange Bitget suspended all QUBIC token deposits and withdrawals as a precaution following the October 18, 2026 mainnet halt
• ▪Restoring QUBIC token deposits and withdrawals on Bitget and managing frozen assets on MEXC remain pending resolution following the October 18, 2026 Qubic wallet drain
• ▪Cryptocurrency exchange MEXC froze the receiving account holding 12.9% of the drained QU tokens within one hour of the October 18, 2026 Qubic wallet drain

Victim compensation process

• ▪Qubic instructed victims affected by the October 18, 2026 wallet drain to file official police reports as part of the formal paper trail for potential compensation
• ▪Deciding whether to compensate victims of the October 18, 2026 Qubic wallet drain rests with Qubic's Computor cluster, the group of network operators who vote on governance decisions

Peripheral security incidents

• ▪The August 2026 Vottun Bridge exploit exposed operational risks tied to outer components, including the Vottun Bridge, of the Qubic network
• ▪In August 2026, the Vottun Bridge linked to the Qubic network was exploited in a security incident separate from Qubic's October 18, 2026 wallet drain