Qubic has restarted its layer-1 blockchain and begun returning funds to verified wallet owners after a seed-generation vulnerability allowed an attacker to drain approximately $1.4 million in QU tokens from 1,404 accounts.
Summary
- Qubic has resumed blockchain operations after a wallet vulnerability led to approximately $1.4 million in stolen QU tokens.
- The project’s Computor quorum approved a recovery arrangement, and Qubic says initial funds have reached verified owners.
- The October attack affected 1,404 wallets and involved approximately 2.94 trillion QU.
- Users who created web wallets before version 4.26.4 must generate new wallets, even if their balances were untouched.
- Affected holders can file recovery claims until May 1, 2027, using the project’s official portal.
In an October 20 recovery announcement on X, Qubic said its Computor quorum approved the recovery arrangements, allowing the network to resume normal operations and opening a claim process for affected users. Initial funds had already been returned, although the project did not disclose how much had been paid or how many claims were approved.
The chain resumed processing after a halt imposed on October 18 to prevent more stolen tokens from moving. Affected users have until May 1, 2027, to submit claims through the project’s designated recovery platform.
Computors approve Qubic recovery after network halt
The attack occurred between late October 17 and early October 18, according to Qubic’s earlier security update. An attacker accessed wallets generated with insufficiently random recovery seeds, obtaining roughly 2.94 trillion QU.
Qubic halted the blockchain at tick 85,371,949. The pause gave operators time to restrict transfers while the team investigated affected addresses and prepared a recovery proposal for the Computors, the participants responsible for consensus decisions.
The project previously estimated that 87.1% of the stolen tokens remained on the network when it stopped. The other 12.9% had reached cryptocurrency exchange MEXC, which Qubic said froze the receiving account within approximately one hour.
As crypto.news previously reported, the initial response left the chain suspended while operators considered how to recover the assets. At that stage, the recovery plan had not received approval.
The October 20 announcement confirmed that the quorum vote had since taken place. Qubic said the affected funds were moved into protected escrow during the shutdown, allowing repayments to verified owners.
Its blockchain explorer provides a reference to ticks beyond the original stopping point. The precise restart time could not be independently established from the explorer’s publicly accessible text.
Older Qubic wallet seeds remain vulnerable after software fix
The vulnerability concerned wallet seed generation, not a reported compromise of the blockchain’s consensus mechanism. Insufficient randomness made some recovery phrases predictable, potentially allowing an attacker to reconstruct the credentials controlling affected accounts.
Qubic’s original incident update identified seeds generated through browsers on iPhones and iPads, Safari on Mac computers and older versions of its iOS application among the affected categories.
The project’s latest advice is more straightforward.
“If you created your wallet with the Qubic web wallet before version 4.26.4 (released 19 October), treat it as insecure, even if your funds were never touched,” the team warned.
Qubic maintains its official wallet code on GitHub and said version 4.26.4 addressed the seed-generation weakness. Updating the application, however, does not replace a recovery phrase that was generated using the vulnerable software.
Users must install the updated wallet, generate an entirely new recovery phrase and transfer their remaining funds to the new address. Continuing to use an old seed would leave the same credentials exposed.
A separate October Ledger security investigation identified an unauthorized hardware implant in one affected device. Unlike Qubic’s software-related weakness, that case involved suspected physical tampering with a wallet distributed through a reseller.
Recovery claims require evidence beyond wallet signatures
Qubic’s official fund reclaim platform allows affected users to check an address, submit a claim and track its status.
Claimants need their compromised source identity, a newly generated destination identity, a signed message and supporting proof of ownership.
The portal explains that wallet signatures alone cannot resolve ownership disputes because an attacker who can reproduce a compromised seed may generate the same valid signature.
Supporting evidence may include exchange withdrawal receipts, private transaction records or a funding trail from another wallet demonstrably controlled by the claimant. Optional identity verification is available, but the platform says it is not mandatory.
Qubic warned users against impersonators offering assistance through private messages. The team said it would never request recovery phrases or initiate direct messages asking users to file claims.
Earlier wallet seed flaws show why migration is necessary
Weak seed generation has affected other cryptocurrency wallets. In July 2026, Coldcard disclosed a firmware-related randomness problem that reportedly exposed hundreds of Bitcoin wallets.
The earlier Qubic incident report discussed that case alongside the 2023 Libbitcoin Explorer vulnerability, which allowed attackers to predict certain wallet seeds.
In each case, replacing vulnerable software did not automatically make previously generated credentials secure. Qubic said a complete technical report on its October incident would follow.
