Qubic Restarts Network After 2.94 Trillion QU Theft, Opens Recovery Claims

Qubic has restored its blockchain operations following the theft of 2.94 trillion QU from 1,404 wallets, with its Computor quorum approving a recovery plan and the first funds returned to verified owners.

The October 20 update marks the network’s recovery from an emergency shutdown triggered by an exploit involving predictable wallet recovery seeds. Affected funds have been moved into protected escrow, while a dedicated claims platform is accepting reimbursement requests until May 1, 2027.

The network is processing transactions again, although users whose wallets were generated using vulnerable software must migrate to newly secured addresses.

Computor Quorum Approves Recovery and Network Restart

Qubic’s Computors coordinated an emergency halt at tick 85,371,949 on October 18 after attackers exploited weak wallet seeds to transfer approximately $1.3 million worth of QU between 23:42 UTC on October 17 and 01:26 UTC the following day.

The intervention immobilized approximately 87.1% of the stolen tokens on the network. The remaining 12.9%, transferred to cryptocurrency exchange MEXC, were frozen in the receiving account.

During the shutdown, vulnerable holdings were moved into protected escrow accounts, preventing further unauthorized transfers while Computors evaluated the recovery procedure.

The quorum subsequently approved the recovery arrangements and authorized the network’s return to normal operation. Initial repayments have reached verified wallet owners, although the total amount distributed has not been disclosed.

Recovery remains subject to ownership verification, with funds held at MEXC following a separate process dependent on exchange cooperation and law-enforcement requirements.

Wallet Version 4.26.4 Fixes Weak Seed Generation

The attack exploited insufficient randomness in the generation of wallet seeds, allowing the attacker to reconstruct private keys associated with vulnerable addresses.

Certain wallets created through browsers on iPhones and iPads, Safari on macOS, and older versions of Qubic’s iOS application were particularly exposed.

Qubic’s security patch, developed by core contributor Joetom, replaced JavaScript’s insecure Math.random() implementation with the cryptographically secure crypto.getRandomValues() function.

The correction is included in wallet version 4.26.4, which prevents the vulnerable generation method from being used for newly created seeds.

Users who generated wallets through affected software must create entirely new recovery seeds and addresses rather than simply updating their existing wallets. Qubic has advised treating web-wallet identities created before version 4.26.4 as potentially insecure, even if no unauthorized transfers occurred.

Predictable recovery credentials have caused substantial losses elsewhere in cryptocurrency. The earlier Ill Bloom wallet flaw involved insufficient randomness that exposed cryptocurrency addresses to unauthorized access, illustrating why software updates cannot retroactively secure compromised recovery credentials.

Qubic Opens Recovery Claims Until May 2027

Affected users can submit requests through Qubic’s official recovery platform, which requires the compromised wallet’s public address, a newly generated secure destination address and evidence establishing legitimate ownership.

Claimants must sign a verification message using their affected identity, but signatures alone are insufficient because the attacker may possess the same compromised private keys.

Acceptable supporting evidence includes exchange withdrawal receipts, previous funding records, OTC transaction confirmations and signatures from unaffected addresses associated with the original wallet.

The recovery process separates straightforward, uncontested claims from cases requiring additional developer review. Approved claims undergo a seven-day dispute period before payment, while competing ownership claims remain frozen until resolved.

Optional identity verification is available through Didit, although users are not required to complete it. The recovery platform does not request wallet recovery seeds or charge reimbursement fees.