Qubic Exploit: 87.1% of Stolen Funds Frozen Within Hours

Blockchain network Qubic suffered a major exploit, and 87.1% of the stolen funds were frozen within hours of the attack, according to AMBCrypto's report on the incident.

The figure matters less as a recovery statistic than as an operational one. A freeze rate above four-fifths within a single trading day indicates the network's validators and coordination channels acted quickly enough to contain most of the outflow before the attacker could launder it through secondary venues. Exploit recoveries typically hinge on that window: funds that sit unmoved for days are far harder to claw back once they cross into mixing services or cross-chain bridges.

Qubic is a layer-1 project led by Sergey Ivancheglo, a founder associated with IOTA and NXT. The protocol uses a useful-proof-of-work model in which miners' computation trains artificial intelligence systems rather than solving arbitrary hashing puzzles.

What does the freeze change for practitioners?

The relevant practical question is what an 87.1% freeze rate changes for teams building on or holding assets within Qubic. Three operational consequences follow.

• Containment speed is the new benchmark. The exploit demonstrates that a coordinated validator response can freeze the overwhelming majority of stolen value before it becomes irrecoverable. Security teams should now model incident response on the assumption that the first hours, not the first days, determine the ceiling on losses.
• Frozen is not returned. The report specifies frozen funds, not returned funds. Freezing prevents movement; it does not automatically restore balances to affected users. The gap between those two states is where legal process, governance votes, or protocol-level compensation mechanisms take over, and each carries its own timeline.
• The residual 12.9% remains live. Just under an eighth of the stolen funds escaped the freeze. That portion represents ongoing exposure for any venue or protocol that might receive the attacker's transfers, and it will pressure exchanges and bridges to screen linked addresses.

The reporting context

AMBCrypto's report did not specify the total value drained, the technical vector of the exploit, or the precise mechanism by which funds were frozen at press time. Those gaps matter for practitioners assessing systemic risk: an exploit rooted in a smart-contract flaw carries different implications than one rooted in validator keys or wallet compromise, and the remediation costs differ accordingly. Watch for a post-mortem from the Qubic team, which should clarify the attack vector and the frozen amount in dollar terms.

What does this change for the broader market structure? Incidents resolved through fast coordination rather than litigation are becoming the expected path, and projects that cannot demonstrate an equivalent response capability will face harder questions from custodians and listing venues. The unfrozen 12.9% now defines the incident's remaining exposure until the team publishes its full accounting.