Qubic has restarted its blockchain after an attacker drained 1,404 wallets of nearly $1.3 million in QU tokens, an incident that forced the network into an emergency shutdown and put the project's wallet tooling — not its consensus layer — at the center of the fallout.

The Oct. 18 attack saw approximately 2.94 trillion QU tokens stolen in less than two hours. Qubic's validators, known as Computors, stopped transactions at tick 85,371,949 to prevent further losses. Qubic itself is a proof-of-work smart contract platform in which network state advances in discrete intervals known as ticks, and the Computors carry out network activity and coordinate decisions through quorum votes. That ability to halt activity through quorum is what gave the network an emergency brake once the theft came to light.

By the evening of Oct. 19, the blockchain was processing transactions again. On Oct. 20, Qubic said its validators had approved a recovery plan, opened a claims portal, and started paying verified victims.

The Qubic network is live again. The Computor quorum approved the recovery, the reclaim platform is open, and the first funds have already gone back to verified owners. Here's what's new and what you need to do. pic.twitter.com/2pIM0IfiFB

— Qubic (@Qubic) October 20, 2026

How the Wallets Were Exposed

The thief did not break Qubic's blockchain. Instead, the attacker exploited weak wallet recovery seeds — the secret strings of characters generated when a wallet is created that give owners full access to their funds. Whoever holds the seed controls the wallet, regardless of any password, which is why predictable seeds can undo every other layer of wallet protection.

Older versions of Qubic's wallet software relied on a random-number generator that was not secure enough, which made some recovery seeds predictable. The flaw affected wallets created through browsers on iPhones and iPads, Safari on Macs, and older versions of Qubic's iOS app — the creation paths that shared the weak generator. Attackers could potentially rebuild these seeds and gain access without knowing the owner's password.

Qubic said it fixed the problem in wallet version 4.26.4, released around Oct. 19. The update replaced the weak generator with a more secure method.

Updating the software does not repair an old recovery seed, however. Anyone who created a wallet with the affected software must create a new wallet and move their funds there. Simply opening the old wallet on another device will not make it safe.

Stolen Funds Frozen as Claims Open

The thief's escape plan stalled when Qubic halted its network, preventing the bulk of the haul from leaving the chain. About 87.1% of the stolen tokens stayed trapped on the blockchain, while crypto exchange MEXC froze an account holding the remaining 12.9%. Qubic then placed the affected onchain funds into protected escrow so validators could return them to verified owners.

Victims can submit claims through Qubic's official recovery portal until May 1, 2027. Applicants must provide their affected wallet identity and a newly generated destination wallet, along with a signed ownership message and supporting evidence. Approved claims face a seven-day dispute period before payment.

Recovery of the funds held at MEXC depends on the exchange and any law enforcement proceedings. That leaves the 12.9% held off-chain as the portion of the haul whose fate remains open, while the onchain share works its way back to verified owners through escrow and the claims process.

Qubic has also warned users about recovery scams. The team said legitimate recovery help never requires handing over a wallet seed or paying a fee. For affected users, the required steps are straightforward: file a claim through the official portal, generate a fresh wallet, and never share an existing seed with anyone offering assistance.

Payments to verified victims began on Oct. 20, and the claims window remains open until May 1, 2027.

Source: Blockonomi