Qubic Halts Blockchain After $1.4 Million QU Token Theft

The cryptocurrency Qubic has shut down its own layer-1 blockchain after hackers exploited a security issue in users' wallets and stole about 2.94 quadrillion QU tokens worth $1.4 million. According to an official statement from the Qubic Core Team dated October 18th, the attacker targeted wallets with weak seeds due to insufficient randomness, allowing them to discover private keys. The network paused at tick 85,371,949 to prevent further transfers of the stolen tokens.

Investigation and Asset Recovery

Qubic reported that 87.1 percent of the stolen money remained inside the system until its termination, whereas 12.9 percent was already transferred to the cryptocurrency exchange known as MEXC. The project claimed the exchange blocked the receiving account in less than one hour. Qubic has not updated on when the blockchain will restart, as the retrieval of stolen assets is pending a decision from the network operators, referred to as Computors.

The vulnerability exploited a weakness in the mechanism used by specific types of Qubic wallets to create recovery seeds. This can then be exploited to access the wallet without needing to know the recovery phrase. The reason is that poor randomisation during recovery seed generation makes it easier to reverse-engineer the private key. Qubic categorised these compromised wallets into groups based on the device, browser, and application used to create the recovery seed.

The network freeze has resulted in the theft of most tokens, which are now frozen until the development team finalises a plan to recover them. According to figures Qubic provided, approximately 2.56 trillion QU remained on the blockchain after transactions became unavailable. The remaining 379.26 billion QU had been moved to MEXC. However, after contacting the exchange, the receiving address was locked. After that, the project halted QUBIC deposits and withdrawals on MEXC at its request. This prevented customers from moving tokens through the network during the investigation.

Software Fix and Security Updates

Qubic claimed that the vulnerability in seed generation has been addressed in the latest version of their web wallet. According to a GitHub commit for version 4.26.4, Qubic now uses crypto.getRandomValues(), a cryptographically secure method for generating random values, instead of JavaScript's Math.random() function.

Qubic stated that its core team is working on determining the impacted wallets and developing recovery solutions for approval by the Computors of the network. The team said it will provide a complete technical report once it finalises the recovery solution. It has yet to announce when the network will resume its operations.

Another similar incident occurred when 500 separate wallets, containing 584 Bitcoin, worth about $38 million, were attacked and stolen from the Coldcard wallet. The attack was traced to a flaw in how Coldcard generated its keys. 1,324 chunks of BTC were moved across 500 transactions inside a three-block window.

In another report, Galaxy Digital chief researcher Alex Thorn said in August that at least 15 different hackers have used this Coldcard vulnerability. Thorn explained that the victims' reports were useful because they enabled the firm to tag new hackers who would otherwise remain anonymous, since it was a different kind of exploit than the one carried out on a centralised exchange.