Qubic Restarts Network Following $1.4M Exploit as Users Seek Recovery

 

Qubic has restarted its Layer-1 blockchain after an exploit drained roughly $1.4 million worth of QU tokens from 1,404 accounts. The network had been halted while its validators worked on a recovery plan, and affected users can now submit claims for potentially recoverable funds.

The incident was linked to a weakness in the way some Qubic wallets generated recovery seeds. While the blockchain itself was not reported to have suffered a consensus-level compromise, the wallet issue gave an attacker access to a large number of vulnerable accounts. Qubic has since released a software fix and moved into the recovery phase.

 

Qubic resumed blockchain processing at around 8:00 p.m. UTC on October 19, according to its blockchain explorer. The network moved beyond tick 85,371,949, where processing had been stopped during the incident.

The decision followed approval of a recovery plan by Qubic's validators, known as "Computors". Their role was particularly important because the network halt was used as a protective measure while the project assessed the stolen assets and determined its next steps.

The restart means normal blockchain processing has resumed, but the incident is not considered fully resolved. Qubic still needs to work through the recovery claims and determine how affected balances will be handled.

 

The exploit originated from insufficient randomness in the generation of certain wallet seeds. A seed is used to derive the private credentials that control a crypto wallet. If the seed is predictable, an attacker may be able to reproduce the credentials needed to access the wallet.

Qubic said the vulnerability affected seeds created through its web wallet in certain environments, including browsers on iPhones and iPads and Safari on Mac devices before the issue was fixed. An older version of the Qubic iOS application was also among the affected software.

The attacker reportedly drained approximately 2.94 trillion QU from the vulnerable accounts between October 17 and October 18. Qubic then halted the network to limit further movement of the stolen tokens.

The project's response also included an update to its web wallet. Version 4.26.4 introduced a new method for generating random values. Qubic has warned users who created wallets with versions before 4.26.4 to treat those wallets as insecure and move their funds to newly created wallets.

 

With the blockchain operational again, Qubic has opened a claims platform for users whose wallets were affected. Holders can check their wallet addresses and submit claims through the recovery process.

The claims period is scheduled to remain open until May 1, 2027, giving affected users several months to complete the process. Qubic's recovery plan is particularly significant because a large portion of the stolen tokens remained within the network rather than being moved away.

Reports indicate that about 87.1% of the stolen QU remained frozen on-chain, while the remaining portion was transferred to an exchange account that was subsequently restricted.This could give Qubic a better opportunity to recover affected assets than cases where stolen crypto is rapidly moved across multiple networks. However, the existence of frozen funds does not by itself guarantee that every affected user will receive a full recovery.

The recovery process will therefore be an important test for Qubic. How efficiently the project handles claims and distributes any recovered assets could influence user confidence after the exploit.

 

Qubic's blockchain is operational again, but the project's response has now entered a more important stage. The network restart and restores transaction processing, while the claims program gives affected users a path toward recovering their losses.

The incident also shows that blockchain security is not limited to the underlying network. A weakness in wallet software and seed generation can expose users even when the core blockchain continues to operate normally.