# Is my Qubic wallet safe? Not if its seed was made on an iPhone, iPad or Safari before 18 October

Source: trenchbook.app · filed Oct 18, 2026, updated Oct 18, 2026 · https://trenchbook.app/dispatch/qubic-wallet-drain-safe

> There is no official trenchbook token or contract address (CA). Anyone selling one is not us.

**In short:** Qubic wallet drain, checked 18 October 2026: between 23:42 UTC on 17 October and 01:26 UTC on 18 October, 1,404 Qubic wallets were emptied of about 2.94 trillion QU. Qubic says the cause was weak randomness when some seeds were created: on any browser on an iPhone or iPad, or Safari on a Mac, before 18 October, or the Qubic iOS app before July 2025. The network has been halted at tick 85,371,949 since then. On-chain, 2.56 trillion QU sits unmoved on eight wallets and 379 billion went to an address Qubic says belongs to MEXC. The community checker at qubicmap.org/check only compares your public address against a fixed list inside your browser.
Is my Qubic wallet safe? If its seed was created on an iPhone or iPad in any browser, or in Safari on a Mac, before 18 October 2026, or in the Qubic iOS app before July 2025, treat that seed as weak, even if your wallet wasn't drained. That's Qubic's own list, from [its incident thread](https://x.com/_Qubic_/status/2111796743348371956) at 8:29 AM ET today. Qubic says the weakness was "in seed generation, not in the Qubic protocol itself", and that seed creation is fixed in version 4.26.4. Seeds made elsewhere aren't on its list.
Should I log in to check? There's no rush, and nothing you do right now can move funds, yours or anyone's. The network has been stopped since the drain: Qubic says computors halted it at tick 85,371,949, and when we asked Qubic's public RPC at 8:37 AM ET today, its latest tick was [still 85,371,949](https://rpc.qubic.org/v1/tick-info). If you want to know whether your wallet was hit, you only need your public address (60 letters), never your seed. When the network restarts, follow Qubic's official instructions on moving funds off an affected seed.
What happened. Between 7:42 PM and 9:26 PM ET on 17 October (23:42 to 01:26 UTC), an attacker emptied [1,404 wallets of about 2.94 trillion QU](https://x.com/_Qubic_/status/2111796725677715474), in Qubic's words. Qubic says a flaw in seed generation let the attacker work out those seeds; its full technical report is still to come. The community list behind qubicmap.org's checker has the same count and total: 1,404 addresses and 2,939,606,531,944 QU, all swept into seven collecting wallets in that window.
Where the QU is now. We checked each collecting wallet on Qubic's public RPC. Five have never sent anything out and hold 2.07 trillion QU between them. One, [XVPY…QXDI](https://explorer.qubic.org/network/address/XVPYBEQNKNBKVCFPVGCFFNBZDEBDGJWVGDCBDBQBCFPRQKJNYXIJJWFDQXDI), sent 94 billion QU to an eighth wallet, [RPJP…AKMD](https://explorer.qubic.org/network/address/RPJPMIGBLLQLNDMUICFSRFAAUAHASCFRTPGDRKAWPBIIHMLMATEMBMAENKMD), which hasn't moved it, and still holds 359.6 billion itself. The seventh, [TFYI…YVLE](https://explorer.qubic.org/network/address/TFYIRQPKYCPQOEUGRZMKCFQNJKPDMPGGKSWISAYLXAIZKFWKAYRXJMZGYVLE), sent 379.04 billion QU (12.9%) in two transfers at 8:38 and 8:49 PM ET to [DKYO…HNQG](https://explorer.qubic.org/network/address/DKYOWQRWAYFDIHPOWVCEJLZFPJHCYWZGDRHQJEFJFDMTPUYVLLPRYMTBHNQG), which passed all of it on within minutes, the way an exchange deposit address does; TFYI still holds 35.7 billion. Together those eight wallets, the seven collectors and RPJP, hold 2.56 trillion QU, 87.1% of what was taken, matching Qubic's figure. Qubic says the 12.9% went to MEXC and that MEXC froze the receiving account within about an hour. We can't see MEXC's side, so the freeze is Qubic's account.
Is qubicmap.org/check safe? From its code, yes for what it asks: your public address. We read the page as served at 8:40 AM ET today. It downloads one fixed file, the list of drained addresses, and compares what you type against it inside your browser. Nothing you type is sent to the site or anyone else; the only other script is Cloudflare's standard bot check. It doesn't ask for a seed, connect a wallet or ask you to sign anything. It's a community page, not Qubic's, and a page can change after we read it, so never paste a seed there or anywhere.
What to do if you were drained. Qubic asks victims to file a police or cybercrime report with the wallet ID, the amount and the transaction link from [explorer.qubic.org](https://explorer.qubic.org), because formal reports help exchanges keep funds frozen. Any return of funds is up to a vote of the computor quorum; Qubic says a community poll is open on Discord.
Watch for recovery scams. Qubic says nobody from its team will message you first, ask for your seed or offer paid recovery. Anyone who does, after a drain like this, is the next scam.

## What we don't know

- Who ran the drain.
- Whether the computor quorum will move or return the frozen QU, and when the network restarts.
- Exactly how weak the affected seeds were; Qubic says a full technical report will follow.

## The claims, checked

- "An attacker drained 1,404 Qubic wallets, totalling around 2.94 trillion QU." (Qubic (@_Qubic_)): **holds**. The community list of drained addresses has 1,404 entries totalling 2,939,606,531,944 QU, and the seven collecting wallets received that same total. [Qubic's thread](https://x.com/_Qubic_/status/2111796725677715474) [Largest collecting wallet, VNJZ…DRCM](https://explorer.qubic.org/network/address/VNJZRGGRYRTKHANUZHLTHTSBQOFCTCJKUKLCVIWCSBRTZNYOJEVPGYDCDRCM)
- "Computors coordinated a protective halt of the network at tick 85,371,949." (Qubic (@_Qubic_)): **holds**. Qubic's public RPC still reported tick 85,371,949 at 8:37 AM ET on 18 October. [Qubic RPC tick info](https://rpc.qubic.org/v1/tick-info) [Qubic's thread](https://x.com/_Qubic_/status/2111796748176007322)
- "87.1% of the drained funds never left the Qubic network… The remaining 12.9% was sent to MEXC." (Qubic (@_Qubic_)): **holds**. The seven collecting wallets and RPJP…AKMD, which got 94 billion from one of them, hold 2.56 trillion QU between them; five collectors never sent anything. 379.04 billion went from TFYI…YVLE to DKYO…HNQG and on within minutes. That it's MEXC's, and that MEXC froze it, is Qubic's account. [TFYI…YVLE (sent the 379.04B)](https://explorer.qubic.org/network/address/TFYIRQPKYCPQOEUGRZMKCFQNJKPDMPGGKSWISAYLXAIZKFWKAYRXJMZGYVLE) [DKYO…HNQG](https://explorer.qubic.org/network/address/DKYOWQRWAYFDIHPOWVCEJLZFPJHCYWZGDRHQJEFJFDMTPUYVLLPRYMTBHNQG)
- "The search runs in your browser: nothing you type is sent anywhere." (qubicmap.org/check): **holds**. The page's only request is a fixed list file, fetched without your input; the comparison happens in the page's own script. Read 18 October, 8:40 AM ET. [The checker](https://qubicmap.org/check) [The list it downloads](https://qubicmap.org/check/victims.json)

## Sources

- project: [Qubic: security incident thread, 18 Oct 2026](https://x.com/_Qubic_/status/2111796725677715474)
- project: [Qubic: which seeds are affected](https://x.com/_Qubic_/status/2111796743348371956)
- chain: [Qubic public RPC: current tick](https://rpc.qubic.org/v1/tick-info)
- chain: [Qubic explorer](https://explorer.qubic.org)
- researcher: [qubicmap.org: drained-address checker (community)](https://qubicmap.org/check)