Qubic traced the drain to wallet seeds generated with JavaScript's Math.random(), so the patched client protects only wallets created after the fix. The network stoppage is the only thing holding the 87 percent of the stolen QU that never left the chain.
Qubic stopped its mainnet on Sunday after an attacker emptied 1,404 user wallets, and the stoppage is now the only thing holding most of the stolen balance in place. The Computors who operate the decentralized AI computing network halted the chain at tick 85,371,949, stranding most of the roughly 2.94 trillion QU taken from those wallets in addresses that can no longer transact.
The drain itself took 104 minutes, running from 23:42 UTC on Saturday to 01:26 UTC on Sunday according to Crypto Briefing. Accounts of what those tokens were worth do not agree. Crypto Briefing, TechReport and InvestingLive put the figure near $1.3 million, while CoinGape reports roughly $1.4 million. The 2.94 trillion QU is the number all four carry, and none of them names the price source behind either dollar estimate.
The fault sat outside the chain. Qubic's developers say the protocol worked as designed and that the weakness was in how its wallet produced recovery seeds, and the fix shipped as a wallet client release rather than a protocol upgrade. CoinGape reports the seed creation layer used JavaScript's Math.random(), and that client version 4.26.4 replaced it with crypto.getRandomValues(). InvestingLive describes the same flaw as a random number function not designed for cryptographic secrets, which let an attacker narrow the field of possible seeds and then scan for the ones holding funds. An attack of that shape needs no network bug at all. The candidate seeds can be worked out away from the chain, and the chain is consulted only to find out which of them are worth draining.
Exposure depended on where a wallet was created rather than on who held it. CoinGape and InvestingLive separately place the affected set at wallets made in any browser on an iPhone or iPad, in Safari on a Mac before Sunday, or in the Qubic iOS application before July 2025.
A patched generator only changes seeds made after the patch. It cannot alter a seed that already exists, so a wallet created under the old code is as predictable today as it was last week, whatever client version its owner is now running. That is the gap Qubic's developers described closing by hand rather than leaving to the update. They say they secured further funds that were exposed to the same flaw before the attacker reached them.
Most of the money never left. About 87.1 percent of the drained QU stayed on Qubic, where the halt holds it, and the remaining 12.9 percent reached MEXC, which froze the receiving account within about an hour. That is a sharper result than the other token drain of the same weekend, when an attacker minted 10 million CYS through Cysic's cross-chain bridge and the blacklist arrived 48 minutes after the last token had already gone.
MEXC and Bitget have both suspended QUBIC deposits and withdrawals. TechReport reports that MEXC said Qubic's team requested its suspension and that Bitget attributed its own to wallet maintenance. No restart date has been announced for the network or for either exchange's service.
What happens to the frozen balance rests with the Computor cluster, the operators who run the network and vote on its direction. Qubic has not announced a compensation scheme or an amount, and affected users have been told to file police or cybercrime reports citing their wallet ID, the sum drained and explorer links. QEARN, the network's staking product, was untouched.
The two halves of the money sit under different authorities. The 87.1 percent still on Qubic answers to whatever the Computors decide, while the share MEXC froze sits inside an exchange's own compliance process. No account of the incident has either party saying what it would take to release either amount, and the instruction to file police reports is the only recovery step so far that does not run through a vote.
The restart and the recovery decision are also the same decision, because the stoppage is what immobilizes the larger share. Ravencoin met a narrower version of that constraint in August, when two mining pools decided whether four days of transaction history survived after the project asked for a closer recovery point and was refused.
This is the second incident this year to hit something attached to Qubic rather than its core, following the exploit of the Vottun Bridge in August. Seed flaws also sit dormant for a long time. A 2021 Coldcard firmware bug that gutted seed entropy on Mk3 devices went unexploited until this July, when 594 bitcoin left about 500 wallets in 25 minutes. Qubic says a full technical report will follow once a recovery plan is confirmed.
