Qubic has restored blockchain operations following the theft of 2.94 trillion QU from 1,404 wallets, with its Computor quorum approving a recovery plan and the first stolen funds returned to verified owners.

The October 20 update marks the network's recovery from an emergency shutdown triggered by an exploit that leveraged predictable wallet recovery seeds. Affected funds have been moved into protected escrow, while a dedicated claims platform is accepting reimbursement requests until May 1, 2027. The network is processing transactions again, although users whose wallets were generated with vulnerable software must migrate to newly secured addresses.

Computor Quorum Approves Recovery and Network Restart

Qubic's Computors coordinated an emergency halt at tick 85,371,949 on October 18, after attackers exploited weak wallet seeds to transfer approximately $1.3 million worth of QU between 23:42 UTC on October 17 and 01:26 UTC the following day. The project announced the network's recovery in an X post.

The intervention immobilized approximately 87.1% of the stolen tokens on the network. The remaining 12.9%, which had been transferred to cryptocurrency exchange MEXC, were frozen in the receiving account.

Because the weakness originated in wallet seed generation rather than in the network protocol itself, recovery depended on coordinated network action to immobilize stolen tokens and, for the off-ramped share, on exchange cooperation — an illustration that seed-creation security falls outside what on-chain rules alone can protect.

During the shutdown, vulnerable holdings were moved into protected escrow accounts, preventing further unauthorized transfers while Computors evaluated the recovery procedure. The quorum subsequently approved the recovery arrangements and authorized the network's return to normal operation.

Initial repayments have reached verified wallet owners, although the total amount distributed has not been disclosed. Recovery remains subject to ownership verification, and funds held at MEXC follow a separate process dependent on exchange cooperation and law-enforcement requirements.

Wallet Version 4.26.4 Fixes Weak Seed Generation

The attack exploited insufficient randomness in wallet seed generation, allowing the attacker to reconstruct the private keys associated with vulnerable addresses. Wallets created through browsers on iPhones and iPads, Safari on macOS, and older versions of Qubic's iOS application were particularly exposed.

A security patch developed by core contributor Joetom replaced JavaScript's insecure Math.random() implementation with the cryptographically secure crypto.getRandomValues() function. The fix is included in wallet version 4.26.4, which prevents the vulnerable generation method from being used for newly created seeds.

Users who generated wallets through affected software must create entirely new recovery seeds and addresses rather than simply updating their existing wallets. Qubic has advised treating weballet identities created before version 4.26.4 as potentially insecure, even if no unauthorized transfers occurred.

Predictable recovery credentials have caused substantial losses elsewhere in cryptocurrency. The earlier Ill Bloom wallet flaw involved insufficient randomness that exposed cryptocurrency addresses to unauthorized access, illustrating why software updates cannot retroactively secure already-compromised recovery credentials. The parallel underlines why randomness at key creation is treated as a foundational dependency: once seeds are predictable, basic ownership proofs such as signatures lose reliability, since the attacker can produce them too.

Recovery Claims Open Until May 2027

Affected users can submit requests through Qubic's official recovery platform, which requires the compromised wallet's public address, a newly generated secure destination address, and evidence establishing legitimate ownership.

Claimants must sign a verification message using their affected identity, but signatures alone are insufficient because the attacker may possess the same compromised private keys. Acceptable supporting evidence includes exchange withdrawal receipts, previous funding records, OTC transaction confirmations, and signatures from unaffected addresses associated with the original wallet.

The recovery process separates straightforward, uncontested claims from cases requiring additional developer review. Approved claims undergo a seven-day dispute period before payment, while competing ownership claims remain frozen until resolved.

Optional identity verification is available through Didit, although users are not required to complete it. The recovery platform does not request wallet recovery seeds and charges no reimbursement fees.

The recovery arrangements also cover assets held in affected smart-contract positions, including certain QEA holdings. With the claims window open through May 1, 2027, developments to watch include the pace of verified repayments, the handling of contested claims after each seven-day dispute period, and the MEXC-frozen 12.9%, which hinges on exchange cooperation and law-enforcement requirements.