Qubic: Predictable Secret Wallets at the Heart of the Incident

An Incident Involving Recovery Secrets

Qubic published on October 18, 2026 a post‑incident report concerning 1,404 wallets. According to the team, an attacker emptied them between 23:42 UTC on October 17 and 01:26 UTC on October 18, for a total of roughly 2,940 billion QU. The announced cause relates to the generation of certain recovery secrets, with insufficient randomness. The described problem should therefore not be summarised as a change to consensus rules or a capability to decrypt every wallet on the network.

A recovery secret must be hard to guess, even when the method used to produce it is known. If its generation leaves only a reduced set of possibilities, an attacker can search combinations more efficiently than expected. The apparent length of the secret is not enough to establish its robustness. One must also consider the quality of the randomness employed during its creation. A transaction signed with a compromised secret can later be recognised by the network, without the blockchain being able to know that the signature comes from an attacker.

Environments Identified by the Team

In its explanatory thread, Qubic points to secrets created on iPhone or iPad in a browser before October 18, 2026, those produced on Mac with Safari before that date, as well as those generated by the iOS Qubic app before July 2025. This scope is the one communicated by the project. It does not allow one to claim that every Apple device is compromised nor that all users of the cited environments actually lost funds. The assessment of a particular wallet depends, among other things, on how its secret was generated.

Qubic also states that it has fixed the generation process in version 4.26.4. A software fix and the protection of secrets created earlier must nevertheless be distinguished. Changing the mechanism that produces new secrets does not retroactively turn an old weak secret into a strong one. Likewise, observing tokens at an address does not demonstrate that access remained exclusive to its legitimate owner. The security of the signing method is a different question from the balance displayed by an interface or explorer.

Containment and Restitution Are Two Separate Steps

The team indicates that network operators coordinated a protective shutdown. In its October 18 report, it presented 87.1 % of the diverted funds as still held on Qubic and the remaining 12.9 % as sent to MEXC, where the receiving account was said to have been frozen. These details describe the situation announced on that date. They should not be turned into confirmation of a refund, a return to normal operation, or a definitive recovery of assets by victims.

Blocking movements can give investigators time, but restitution still requires separate decisions and actions. Qubic explains that the resolution lies with the quorum of its operators, according to network rules. Subsequent announcements will need to specify the measures actually adopted, their execution, and the fate of the affected wallets. To understand the incident, one must therefore keep three separate levels: the initial generation flaw, the announced containment measures, and the outcomes of the resolution procedure.