We analyzed this claim: is it true that
two unrelated security breaches over October 17–18, 2026, forced Cysic to halt its bridge and Qubic to freeze its network and trading transfers?
Public statements, transaction records, trading platform notices and software updates confirm both attacks and emergency shutdowns, though full financial losses and fund recoveries remain unsettled.
Crypto operators freeze networks after thieves hit two platforms
Operators of Cysic and Qubic halted services over the weekend of October 17–18, 2026, after intruders stole funds through two separate technical flaws.
In a nutshell
Two cryptocurrency platforms froze their networks over the weekend of October 17–18, 2026, after intruders exploited separate weaknesses to steal funds. One attacker manipulated Cysic's bridge system to create 10 million unauthorized tokens, while another guessed weak passwords to drain 1,404 Qubic wallets of 2.94 trillion tokens. Operators responded by blacklisting addresses and halting their entire blockchain, leaving customer balances safe from further theft but locked away until repair plans are formally approved and deployed.
Highlights
- An intruder created 10 million unauthorized CYS tokens through Cysic's bridge system on October 17.
- Qubic operators halted their entire blockchain after an attacker drained 2.94 trillion tokens from 1,404 wallets.
- Approximately 87.1% of stolen Qubic tokens remain frozen on the halted chain, while 12.9% were transferred to exchange MEXC.
- QUBIC fell 5.2% over 24 hours following the shutdown, compared to a 2.8% drop across the broader crypto market.
Where stolen Qubic tokens went
%The findingNearly nine-tenths of the stolen tokens were halted directly on the network before they could reach trading exchanges.
- A breakdown of where the 2.94 trillion stolen Qubic tokens were located when operators froze the network.
- Qubic network — A computing blockchain that was completely frozen by operators to stop theft
- MEXC — A public trading exchange that paused account transfers at the project's request
- It shows that emergency shutdowns can keep stolen funds trapped, but actual recovery still requires new software.
From the Editor’s Diary
When digital networks suffer severe breaches, their operators have the power to freeze systems and block customer access. Stopping a theft is only half the battle; returning the money requires complex governance steps that leave everyday users waiting on the sidelines.
Who's involved
Cysic Foundation
Non-profit group overseeing Cysic, a computing network that verifies digital transactions
goal → Stop counterfeit token creation, trace missing money, and safely reopen its transfer bridge
Unidentified Cysic attacker
Unknown intruder who broke into Cysic's bridge system and generated counterfeit tokens
goal → Sell the newly created tokens for cash-like crypto assets before systems freeze
Qubic Core Team and Computors
Software creators and the 676 governing computers that run and approve the Qubic network
goal → Halt ongoing wallet thefts, secure vulnerable customer accounts, and agree on a plan to restart the network
Unidentified Qubic attacker
Unknown intruder who emptied digital wallets by guessing weak security keys
goal → Move stolen tokens onto public trading markets before accounts are frozen
MEXC
Commercial cryptocurrency exchange where people buy and sell digital coins
goal → Block suspected stolen tokens and halt deposits to protect its trading marketplace
Bitget
Global cryptocurrency trading platform that lists digital assets
goal → Suspend deposits and withdrawals for the affected tokens to prevent disputed trades
In short
Two separate security breaches forced cryptocurrency operators to shut down critical systems over the weekend of October 17–18, 2026, showing that users can abruptly lose access to their funds when operators step in to stop a theft.
The most important next step is that operators must successfully deploy software fixes and distribute held assets before customers can safely trade or withdraw their money again.
Whether users recover their money remains uncertain, because technical repair plans exist only in code and have not yet been carried out or approved across the networks.
Flagged by: Crypto Barometer · 19 October 2026
How it unfolded
Fake transfer order creates ten million tokens on Cysic
An intruder broke into a supporting database behind Cysic's cross-chain bridge, a tool that transfers assets between separate blockchains, at 12:31:38 UTC on October 17. The intruder used that access to send a fake command that minted 10 million CYS tokens on the BNB Smart Chain network. This breach altered expectations by proving that bridge databases could be manipulated to create tokens out of thin air.
Intruder sells new tokens before defenses lock down
The intruder immediately moved the newly minted tokens onto open markets before anyone could stop them. Records show the attacker sold roughly 7.2 million tokens across decentralized exchanges, swapping the proceeds into other cryptocurrencies and moving them onto the Ethereum network. Cysic blacklisted the receiving address 76 minutes later, freezing the remaining 2.8 million tokens. The intervention protected those remaining tokens, but it could not claw back the funds that had already left the network.
Predictable passwords let a second thief drain Qubic wallets
Late that evening, a separate attack hit the Qubic network. Digital wallets rely on random secret words, called seeds, to create passwords that lock customer balances. On certain Apple devices, Qubic's wallet software generated these keys using weak mathematical randomness, allowing an attacker to guess passwords and take user funds. The thief swept 1,404 wallets over 104 minutes until network operators coordinated an emergency shutdown, freezing the entire blockchain to stop further losses.
Exchanges pause transfers as projects issue emergency code
By Sunday, trading platforms stepped in to contain the fallout. Qubic issued an updated wallet application that uses secure randomness to protect newly generated accounts, while Bitget and MEXC halted deposits and withdrawals for both affected tokens. Cysic announced that its core blockchain remained secure and that an outside security firm was investigating the bridge breach. These containment measures broke the chain of theft, but they left everyday account holders unable to access or move their balances.
Markets drop as developers write code to seize stolen assets
The market repriced the affected tokens on Monday as investors absorbed the risks of frozen systems. QUBIC fell 5.2% over 24 hours, dropping faster than the wider cryptocurrency market. That evening, Qubic developers published new core software designed to cancel open exchange orders, freeze compromised accounts, and move stolen tokens into a holding escrow account. While the code has been written, network operators have not yet turned it on, meaning victims have not received their money back.
Where things stand
As of October 20, 2026, both security breaches are confirmed, but neither project has fully reopened or settled customer accounts. Cysic keeps its transfer bridge closed while external investigators examine the database intrusion. Blockchain records indicate an attacker moved roughly $727,000 worth of ether to another network, while 2.8 million minted tokens remain locked under a blacklist.
Qubic's blockchain remains turned off. Developers have written code to move stolen funds into an escrow holding account, but network operators have not yet voted to run the software, restart the network, or return tokens to owners. Until operators verify the fixes and exchanges lift transfer bans, everyday users cannot withdraw or trade their funds on either platform.
Sources
- Qubic, wallet version 4.26.4 release
- Qubic wallet repository, cryptographically secure seed-generation code change
- Bitget, QUBIC deposit and withdrawal suspension notice
- MEXC, project-requested QUBIC deposit and withdrawal suspension