The Qubic layer-1 network has resumed normal operation following a brief halt triggered by a wallet-seed vulnerability that allowed an attacker to empty 1,404 accounts of roughly 2.94 trillion QU tokens, valued at approximately $1.4 million at the time.
Project operators known as Computors approved a recovery plan, after which the team moved affected balances into a protected escrow and launched a dedicated claims portal so legitimate owners can request the return of their funds.
The incident stemmed from insufficient randomness during seed generation in older versions of the Qubic web wallet.
Seeds created on certain Apple devices and browsers—any browser on an iPhone or iPad before 18 October 2026, Safari on a Mac up to that date, or the official iOS app before July 2025—were predictable enough for an attacker to regenerate private keys.
The drain occurred in a window of under two hours spanning late 17 October to early 18 October.
The network was stopped at tick 85,371,949 to freeze further movement.
According to the project, 87.1 percent of the tokens never left the chain and stayed frozen, while the remaining 12.9 percent reached the MEXC exchange, which locked the destination account within about an hour.
The Qubic network is live again.
The Computor quorum approved the recovery, the reclaim platform is open, and the first funds have already gone back to verified owners.
Here's what's new and what you need to do. pic.twitter.com/2pIM0IfiFB
— Qubic (@_Qubic_) October 20, 2026
A subsequent node update swept identified weak-seed identities (including some that had not yet been drained) into escrow and canceled related open orders.
Explorer data shows the chain began producing new ticks again at 20:00 UTC on 19 October, advancing past the prior halt point.
With the Computor quorum’s approval in place, the official reclaim platform at weak-seed-reclaim.qubic.org went live.
Affected users can check whether their 60-character identity appears on the published list, generate a fresh secure destination identity in wallet version 4.26.4 or later, and submit a claim backed by a signed message plus supporting evidence.
Because the original seeds are weak, a signature alone does not prove ownership; additional verification is required.
The claim window remains open until 1 May 2027.
Approved claims are listed publicly for a seven-day dispute period before payout, and the project has already returned an initial batch of funds to verified owners.
Developers patched the underlying random-number generator flaw in web-wallet release 4.26.4 (issued 19 October), replacing JavaScript’s Math.random() with the cryptographically secure crypto.getRandomValues() function so that no new weak seeds can be created.
The team has advised anyone who generated a wallet with any earlier web-wallet version to treat it as insecure even if no funds were taken: update the client, create an entirely new wallet on an unaffected device or browser, move remaining assets promptly, and never reuse the old seed.
The project emphasizes that it will never initiate direct messages, request a seed, or charge a recovery fee, and that only the official reclaim site should be used. A full technical report is expected once recovery procedures progress further. Holders and network participants are directed to monitor official project channels for any additional updates.
