Qubic halts its network and Cysic suspends its bridge after weekend exploits
Qubic said 1,404 wallets were drained of about 2.94 trillion QU tokens. Cysic said 10 million CYS tokens were minted without authorisation through its bridge.
Two crypto projects shut down parts of their systems after separate security incidents over the weekend, according to statements they posted on X.
Qubic
Qubic said an attacker drained 1,404 wallets of about 2.94 trillion QU tokens between 23:42 UTC on 17 October and 01:26 UTC on 18 October (10:42am to 1:26am GMT on Sunday). Bitcoin.com News put the value at about $US1.3 million.
The project said some wallet seeds had been generated “with insufficient randomness” and that the issue was in seed generation, “not in the Qubic protocol itself”. It listed affected seeds as those created on iPhones or iPads in any browser or on Macs using Safari before 18 October, and in the Qubic iOS app before July 2025.
The network’s validators, known as Computors, halted it at tick 85,371,949. Qubic said 87.1% of the drained funds had not left the network, and the remaining 12.9% went to the exchange MEXC, which froze the receiving account within about an hour. It said seed generation was fixed in version 4.26.4 and that any resolution for affected users is a decision for the Computor quorum.
Cysic
Cysic, which runs a network for generating zero-knowledge proofs, said 10 million CYS tokens were minted without authorisation through its cross-chain bridge on 17 October. It said user wallets and mainnet operations were not affected and the bridge remains suspended pending a security review.
On-chain records show the attacker sold 7.2 million of the tokens and moved about 306.6 ETH, worth about $US727,000, to Ethereum before Cysic blacklisted the address, freezing the remaining 2.8 million CYS, The Block reported. Cysic has not given a dollar figure for its losses.
Sources
- Security incident update (thread) · Qubic on X
- Qubic Loses $1.3 Million in Wallet Raid Before Network Halts · Bitcoin.com News
- Cysic incident statement · Cysic on X
- Cysic suspends bridge after attacker mints tokens and moves $727,000 to Ethereum · The Block
Related coverage
All crypto →
CISA urges immediate patching of PHP2Shell flaws in PHP, used by 69.3% of websites
US agency CISA told organisations to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and to take unpatchable systems offline. Cloudflare reported early attack attempts; CISA said it had not observed exploitation.
Wallet maker NGRAVE says fake app alert led to at least $2.56 million in crypto thefts
Attackers used a third-party notification provider to send LIQUID app users a fake security alert linking to a copycat site that asked for recovery phrases, NGRAVE said.
PHP releases emergency patches for two critical 'PHP2Shell' remote code execution flaws
The PHP security team urged administrators to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; Cloudflare said it had seen early attack attempts and the UK's NCSC told organisations to patch or take systems offline.
Crypto hacks cost $1.18 billion in third quarter, security firm Hacken says
Hacken counted 107 incidents from July to September, with losses up 55% from the previous quarter. It said most of the money was lost through suppliers, unapplied fixes or systems outside audits.
Google quantum chip result revives debate over risk to older bitcoin wallets
Google says its Willow chip cut errors in a key quantum computing step about 40-fold. Crypto researchers disagree on what that means for when bitcoin's cryptography could be at risk.
