An attacker drained 1,404 Qubic wallets of about 2.94 trillion QU — roughly $1.29 million at current prices — between 23:42 UTC on October 17 and 01:26 UTC on October 18. Qubic traced the theft to wallet seeds generated with insufficient randomness, not to a flaw in the protocol itself. The token fell 5.2% over 24 hours to $0.0000004394, nearly double the 2.8% decline across the total crypto market.
The seeds that couldn't keep a secret
The weakness was in how some wallets were created, not in Qubic's core code. Seeds made in any browser on an iPhone or iPad before October 18, 2026 are affected. So are seeds generated with Safari on a Mac before that date, and seeds from the Qubic iOS app created before July 2025. Version 4.26.4 of the software fixes the weak seed generation, Qubic said.
That's a wide net for a bug that comes down to randomness. Anyone who set up a wallet through those paths during the exposure window should assume the seed is compromised.
A network halt at tick 85,371,949
Qubic's Computors coordinated a halt at tick 85,371,949, stopping all transactions and locking the stolen funds in place. It worked: 87.1% of the drained funds stayed on Qubic's network. The remaining 12.9% went to MEXC, which froze the receiving account within about an hour. Exchanges have since suspended QUBIC deposits and withdrawals.
The stolen money is now a frozen pile on a stopped chain. What happens to it is another matter — Qubic said any resolution is a decision for the Computor quorum under network rules, and the Core team is mapping affected identities and drafting proposals for the quorum.
Cysic's bridge, hit the same day
The Qubic drain wasn't the only problem that weekend. On October 17 — the same day the Qubic theft began — an attacker minted 10 million unauthorized Cysic (CYS) tokens on BNB Smart Chain through the project's cross-chain bridge. Cysic's early findings point to a breached database behind the bridge's services and flawed processing logic that let the attacker forge a mint message.
Cysic blacklisted the recipient address within about 76 minutes, restricting roughly 2.8 million CYS still sitting there. The bridge remains closed, and Cysic says no existing user assets were stolen. The project hasn't put a dollar figure on the damage yet, noting that the minted amount doesn't equal the final loss.
A rough month for DeFi security
These two bring October's exploit count to 11, according to DefiLlama, with about $6.2 million in disclosed losses so far. The biggest single hit was a $3.8 million bridge logic flaw at NEAR Intents on October 1. Two bridge-related incidents in one weekend is not the direction anyone wanted the month to go.
Next up is the Qubic quorum. The Core team is still mapping which identities sit behind the 1,404 drained wallets and drafting proposals for the Computors to vote on — that vote, and whether MEXC's frozen 12.9% gets returned or burned, is the thing to watch.
