Qubic has restarted its blockchain after a thief drained 1,404 wallets of nearly $1.3 million worth of QU tokens. The attack forced the network into an emergency shutdown.
The Oct. 18 attack saw about 2.94 trillion QU tokens stolen in less than two hours. Qubic’s validators, known as Computors, stopped transactions at tick 85,371,949 to prevent further losses.
By the evening of Oct. 19, the blockchain was processing transactions again. On Oct. 20, Qubic said its validators had approved a recovery plan, opened a claims portal and started paying verified victims.
How the Wallets Were Exposed
The thief did not break Qubic’s blockchain. Instead, the attacker exploited weak wallet recovery seeds, the secret strings of characters that give owners access to their crypto.
Older versions of Qubic’s wallet software used a random-number generator that was not secure enough. This made some recovery seeds predictable.
The flaw affected wallets created through browsers on iPhones and iPads, Safari on Macs, and older versions of Qubic’s iOS app. Attackers could potentially rebuild these seeds and gain access without knowing the owner’s password.
Qubic said it fixed the problem in wallet version 4.26.4, released around Oct. 19. The update replaced the weak generator with a more secure method.
Updating the software does not repair an old recovery seed, however. Anyone who created a wallet with the affected software must make a new wallet and move their funds.
Simply opening the old wallet on another device will not make it safe.
Stolen Funds Frozen as Claims Open
The thief’s escape plan stalled when Qubic halted its network. About 87.1% of the stolen tokens stayed trapped on the blockchain.
Crypto exchange MEXC froze an account holding the remaining 12.9%. Qubic then placed the affected onchain funds into protected escrow so validators could return them to verified owners.
Victims can submit claims through Qubic’s official recovery portal until May 1, 2027. Applicants must provide their affected wallet identity and a newly generated destination wallet.
They must also include a signed ownership message and supporting evidence. Approved claims face a seven-day dispute period before payment.
Recovery of the funds held at MEXC depends on the exchange and any law enforcement proceedings.
Qubic has also warned users about recovery scams. The team said legitimate recovery help never requires handing over a wallet seed or paying a fee.
Payments to verified victims began on Oct. 20, and the claims window remains open until May 1, 2027.
