Qubic Halts Chain as Attacker Exploits Weak Seeds to Drain 1,400 Wallets

Highlights

• The network was paused at tick 85,371,949 to prevent further transfers
• MEXC halted QUBIC deposits and withdrawals during the investigation
• Qubic plans to publish a technical report after finalising recovery measu

The cryptocurrency Qubic has shut down its own layer-1 blockchain after hackers exploited a security issue in users' wallets and stole about 2.94 quadrillion QU tokens worth $1.4 million (roughly Rs. 13.3 crore). According to an official statement from the Qubic Core Team dated October 18th, the attacker targeted wallets with weak seeds due to insufficient randomness, allowing them to discover private keys. The network paused at tick 85,371,949 to prevent further transfers of the stolen tokens. 

Qubic Investigates Wallet Seed Vulnerability as Recovery Plans Remain Pending

Qubic reported that 87.1 percent of the stolen money remained inside the system until its termination, whereas 12.9 percent was already transferred to the cryptocurrency exchange known as MEXC. The project claimed the exchange blocked the receiving account in less than one hour. Qubic has not updated on when the blockchain will restart, as the retrieval of stolen assets is pending a decision from the network operators, referred to as Computors. 

Qubic has not updated on when the blockchain will restart, as the retrieval of stolen assets is pending a decision from the network operators, referred to as Computors. The vulnerability exploited a weakness in the mechanism used by specific types of Qubic wallets to create recovery seeds. This can then be exploited to access the wallet without needing to know the recovery phrase.

The reason is that poor randomisation during recovery seed generation makes it easier to reverse-engineer the private key. Qubic categorised these compromised wallets into groups based on the device, browser, and application used to create the recovery seed.

The network freeze has resulted in the theft of most tokens, which are now frozen until the development team finalises a plan to recover them. According to figures Qubic provided, approximately 2.56 trillion QU remained on the blockchain after transactions became unavailable.

The remaining 379.26 billion QU had been moved to MEXC. However, after contacting the exchange, the receiving address was locked. After that, the project halted QUBIC deposits and withdrawals on MEXC at its request. This prevented customers from moving tokens through the network during the investigation.

Qubic claimed that the vulnerability in seed generation has been addressed in the latest version of their web wallet. According to a GitHub commit for version 4.26.4, Qubic now uses crypto.getRandomValues(), a cryptographically secure method for generating random values, instead of JavaScript's Math.random() function. 

Qubic stated that its core team is working on determining the impacted wallets and developing recovery solutions for approval by the Computors of the network. The team said it will provide a complete technical report once it finalises the recovery solution. It has yet to announce when the network will resume its operations.

Another similar incident occurred when 500 separate wallets, containing 584 Bitcoin, worth about $38 million (roughly Rs. 360 crore), were attacked and stolen from the Coldcard wallet. The attack was traced to a flaw in how Coldcard generated its keys. 1,324 chunks of BTC were moved across 500 transactions inside a three-block window. 

In another report, Galaxy Digital chief researcher Alex Thorn said in August that at least 15 different hackers have used this Coldcard vulnerability. Thorn explained that the victims' reports were useful because they enabled the firm to tag new hackers who would otherwise remain anonymous, since it was a different kind of exploit than the one carried out on a centralised exchange.

Cryptocurrency is an unregulated digital currency, not a legal tender and subject to market risks. The information provided in the article is not intended to be and does not constitute financial advice, trading advice or any other advice or recommendation of any sort offered or endorsed by NDTV. NDTV shall not be responsible for any loss arising from any investment based on any perceived recommendation, forecast or any other information contained in the article.