Between UTC time October 17, 23:42 and October 18, 01:26, the Qubic network experienced a night that was almost "flipped over from the wallet entry": the attackers did not directly strike the protocol but seized upon the insufficient randomness in the generation of some wallet seeds, initiating unauthorized access to user assets in less than two hours. According to public materials, around 1,404 wallets were affected, with a total of approximately 2.94 trillion QU/QUBIC being transferred out, resulting in losses estimated at around $1.3 million, a figure currently sourced from a single origin. As abnormal transfers continued to appear on-chain, the Qubic network validators ultimately chose to urgently hit the "pause" button at tick 85,371,949, halting transactions and forcibly shutting down the network to prevent more assets from being transferred away. In the aftermath, the project team clearly pointed to the randomness flaw in the wallet seed generation mechanism as the root cause, emphasizing that the Qubic protocol itself was not breached. However, for ordinary users, witnessing their wallets turning into entry points for the attack overnight and the entire network being paused was enough to shake their fundamental expectations of security and trust.

An Hour of Plundering 2.94 Trillion: Restoration of Attack Path

Starting from around UTC time October 17, 23:42, when the first batch of abnormal transfers appeared, Qubic users' wallets were like doors being quietly opened. In the following 1 hour and 44 minutes, attackers advanced along this pried-open gap: different addresses began to show significant outflows of tokens almost simultaneously, with funds being successively transferred from about 1,404 wallets, until the last batch of assets was emptied at 01:26 on October 18. According to a single source, the total amount of tokens transferred away was approximately 2.94 trillion QU/QUBIC, with an estimated value of around $1.3 million, a figure that was reconstructed afterward, but at that moment on-chain, only appeared as a dense and abnormal series of transfer records.

In a subsequent explanation, the project team pointed to what seemed like a "foundation-level" oversight in the attack path: some wallets had insufficient randomness in their seed generation process before connecting to the Qubic network, giving attackers an opportunity. In other words, the attackers did not breach the protocol itself but exploited the predictable and reconstructable weaknesses of the seed to gain unauthorized access to users' wallets. Some media suggested that older Apple devices might be related to this randomness defect, but specific technical details and the complete method of exploitation were not presented in public materials, and the reliability of such claims remains to be verified. Until the network was paused at tick 85,371,949, public information still did not provide the identity of the attackers, their organizational background, or the subsequent on-chain flow of the stolen assets, making the entire process not only a technical failure but also a narrative of the attack that remains unassembled to this day.

Failure of Randomness: How Wallet Seeds Became Thin Paper

For any on-chain asset, the wallet seed phrase and the private key behind it are the starting point of the entire security model. Mainstream cryptocurrency wallets typically do not "invent random numbers" themselves but instead invoke random sources provided by the device or operating system, allowing the system to select a sequence of numbers that are nearly unpredictable from a vast mathematical space, which is then encoded into seed phrases and private keys. When randomness is sufficient, the attacker faces a key universe that is almost impossible to exhaustively search; however, once randomness is insufficient, this universe becomes compressed into a locked room that can be slowly explored, significantly reducing the actual usable key space. Attackers can lower the guessing range from astronomical levels to a level that computers can patiently test, transforming wallet protection from steel plates to thin paper.

In the Qubic incident, the project team has openly pointed the root cause to the "insufficient randomness in the wallet seed generation mechanism," rather than a flaw in the protocol itself, which equates to admitting that the seeds carried inherent security risks from the moment they left the factory. Some media further mentioned that "older Apple devices" might provide a low-entropy environment, causing certain wallets to generate seeds without the required randomness quality; however, this assertion currently appears only in a single source, and public materials have not provided a complete technical causal chain from device random sources to specific attack paths. More critically, to date, the official has yet to release a detailed technical review or security audit report explaining how attackers ultimately pinpointed these vulnerable seed spaces, and this missing technical review is a key gap in understanding the true boundaries of this attack.

Protocol Innocent or Shifting Blame? The Tug of Security Responsibility

In the absence of a technical review, Qubic's initial conclusion is that "the protocol itself has no flaws; the problem lies in the insufficient randomness of wallet seeds." From a narrative perspective, this statement clearly distinguishes between underlying consensus and peripheral tools: the assets affected are those held by wallet addresses connected to the Qubic network rather than any alteration in on-chain consensus or protocol parameters. Validators collectively paused transactions at tick 85,371,949, more like an emergency measure to "preserve the scene," reinforcing the image that the governance layer of the protocol can intervene proactively. This emphasis on the protocol's innocence is, on one hand, intended to maintain network confidence and avoid panic at the protocol level; on the other hand, in the eyes of the community, it is inevitably understood as a risk narrative aimed at cutting responsibility in advance.

The problem lies in that the "security" that users encounter daily is a composite experience interwoven with wallet interfaces, private key management, on-chain rules, and governance capabilities, rather than finely split technical modules. When the project team clearly points the root cause of the incident to the wallet seed generation mechanism but has not disclosed specific accountability for wallet implementers, security auditors, or development processes in public information, it opens up a space for debate: Have the wallets undergone sufficient independent audits? When recommending or integrating wallets, did the protocol assume design and auditing responsibilities? Since the governance layer can press the "pause" button at critical ticks, should it also bear more responsibility for the security baseline when onboarding ecosystems? For regular users who habitually view "protocol + wallet" as a whole, this incident exposes the reality that the boundary of security responsibility is far more complex than what the product interface displays.

Validators Hit the Brakes: The Risks and Necessity of Network Shutdown

After the attack spanned from UTC time October 17, 23:42 to October 18, 01:26, with approximately 2.94 trillion QU/QUBIC transferred from about 1,404 wallets, Qubic validators chose to pull the emergency brake at tick 85,371,949, pausing network transactions altogether. Beyond this height, on-chain transfers and contract interactions temporarily stagnated, preventing attackers from continuing to spread along the same chain, and the project team thus gained a relatively closed "quarantine period" to investigate vulnerabilities in wallet-side randomness without further losses.

However, the cost of this emergency brake was also direct: the on-chain behavior of all normal users was abruptly halted, and the protocol's usability appeared nearly zero from an external perspective. The fact that validators "can and will stop the network" itself is a shock to the trust of some participants. More tricky is that public materials have not mentioned the duration of this pause, nor have they specified whether on-chain data will be rolled back, leaving many critical observation points unresolved—when the network resumes, will it continue from tick 85,371,949 or restart at a certain safety height? Will the on-chain records during the attack window be treated as “anomalous data” requiring special annotation, or retained as established facts? Whether the acknowledgment and handling of user losses will fully rely on subsequent compensation schemes or partly eased through technical upgrades and governance process adjustments—none of these currently have answers, precisely constituting the core variables in judging whether Qubic can restart the trust machine after the "shutdown."

Lessons Beyond Qubic: The Next Hurdle for Wallet Security

In terms of outcomes, the leak of wallet seeds has affected not just the group of addresses that were attacked. According to AiCoin data, within a window of less than two hours, around 1,404 wallets were unauthorizedly drained, with a total of approximately 2.94 trillion QU/QUBIC, resulting in about $1.3 million worth of losses borne by users and the project team, while the network was forced to hit the pause button at tick 85,371,949. Qubic's security credibility and decentralized narrative have thus been called into question. The project team has acknowledged the root cause lies in insufficient randomness in wallet seed generation rather than a flaw in the protocol itself, shining a spotlight on a long-neglected weak link in the entire industry: whether seed generation algorithms have undergone independent audits, whether device-side entropy sources (especially older hardware) have been rigorously evaluated, and whether there are sufficient "security barriers" in the wallet development and release process. For other on-chain projects and wallet teams, Qubic's shutdown serves as a mirror, reminding everyone not to solely focus on consensus layer and contract security while leaving systemic gaps at the wallet environment level. Moving forward, the publicly available information that warrants continued tracking includes not only a technical review report and fixes for seed generation mechanisms but also clear descriptions of the network recovery path, whether a user remediation and compensation mechanism will be designed, and how to record and constrain the extreme option of "pausing the network" at the governance level. These answers will ultimately determine whether this incident is categorized as an isolated event or seen as a turning point in reshaping wallet security awareness.

Join our community, let's discuss and become stronger together!
Exclusive Hyperliquid benefits for AiCoin: https://app.hyperliquid.xyz/join/AICOIN88
Exclusive Aster benefits for AiCoin: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。