Qubic is officially live again. The team has initiated its recovery process following the recent seed-generation vulnerability that drained $1.4 million in QU across roughly 1,400 wallets, and it has introduced a claims portal through which affected wallet holders can submit requests to recover their funds.

According to Qubic Explorer, the blockchain resumed tick processing at 20:00 UTC on October 19. The network is now processing transactions past tick 85,371,949, following the emergency shutdown on Sunday.

Claims portal open until May 2027

Qubic encouraged affected users to submit claims to restore their funds to secure identities. The team explained that the computor quorum will be responsible for all decisions related to recovery and for implementing the corresponding actions. Users have until May 1, 2027, to file claims via the official claims portal, a window of more than six months from the network's October 19 resumption.

The platform assured users that while the blockchain was unavailable, funds were transferred to a secure escrow wallet. That transfer has become the basis for successful recovery. However, the project warned that any web wallet created before the October 19 version 4.26.4 update is not secure.

"It is vital to update your wallet, transfer all your assets to the new secure address, and stop using old wallets altogether," the team said.

The attacker made away with 2.94 trillion QU from 1,404 wallets. According to the network, the hack resulted from a weakness in seed generation rather than the Qubic protocol itself. "The incident happened because these seeds are weak. That means the attacker can produce the same valid signature you can," the project stated in a post on X. Qubic has since confirmed that the seed-generation flaw has been addressed in the latest version of its web wallet.

Parallels with the Coldcard breach

The incident echoes past security breaches in which flaws in randomness generation left crypto wallets vulnerable to attacks. In late July, hackers exploited a firmware configuration vulnerability in Coinkite's Coldcard, traced back to March 2021, to steal Bitcoin from users.

The hacking was carried out in four separate waves of fraudulent transactions. It began on July 30, 2026, when the hacker stole 594 BTC — almost $38 million — in just 25 minutes. The security threat exploited a weakness in the hardware entropy generation of the affected wallets.

Specifically, a bug in Coldcard firmware version 4.0.1, released in March 2021, broke the algorithm for generating the seed, leading to the creation of recovery phrases with low entropy. As a result, wallets configured with that firmware generated weak private keys that could be easily cracked offline. The flaw in the setup design caused a complete breakdown of cryptographic security, reducing the key space from 128 bits to just 40 bits on outdated hardware. According to research by Galaxy, total losses stand at roughly 1,816 BTC — almost $116 million — spread across 5,200 different addresses.

September saw two major crypto exploits

Blockchain security firm PeckShield documented 55 major exploits in September, with aggregate losses nearing $766.5 million — a 462% increase compared with August's total of $136.3 million. The bulk of the losses came from the Bitget exchange hack, worth $387 million, and the Liquid Network breach, worth $320 million, although Liquid subsequently saw $285 million returned.

According to Gracy Chen, the CEO of Bitget, the attack involved an attacker manipulating backend transaction data to bypass the authorization process. The company will cover the damage itself through its User Protection Fund, which holds a balance exceeding $464 million. As for the Liquid Network incident, 4,000 BTC were withdrawn illegally.

The Qubic incident adds to a growing list of security failures affecting crypto users, exchanges, and wallet providers. Although the causes and scale of these breaches vary, they highlight the importance of secure key generation, rapid incident response, and transparent recovery procedures. They also show how differently restitution can unfold: a dedicated protection fund at Bitget, a partial return of funds at Liquid, and an escrow-backed claims process at Qubic.

For Qubic, the immediate priority is to process claims while ensuring users migrate to secure wallet identities. The volume of claims filed before the May 1, 2027 deadline, and the computor quorum's rulings on them, will determine how much of the stolen value can be recovered and how effectively the network restores user confidence.