Layer-1 blockchain Qubic has restarted its network and begun a formal recovery process after a wallet seed vulnerability enabled an attacker to drain about $1.4 million worth of QU tokens from 1,404 accounts, the project said in its latest update.

According to Qubic’s network explorer, processing resumed on Oct. 19 at 8:00 pm and moved past tick 85,371,949, the point where the chain was previously halted on Sunday. The restart marks the next phase of the response—after the network stoppage was used to prevent additional movement of funds.

Key takeaways

Qubic restarted validator operations after approving a recovery plan and resuming network “ticks” beyond the previous halt point.
The attacker exploited predictable wallet seeds tied to Qubic’s web wallet on certain Apple devices and browsers.
A dedicated claims platform is now live for affected users to submit recovery requests.
Qubic says the web-wallet fix was released as version 4.26.4 on Oct. 19, and older wallets should be treated as insecure.
Claims can be submitted until May 1, 2027.

Network restart after the halt

Qubic suspended network activity on Sunday to limit further risk after the vulnerability was identified. The project’s latest status indicates that validators—known as “Computors”—have approved a recovery plan and are now running the process required to address the damage.

The blockchain explorer’s tick history shows the chain was stationary at tick 85,371,949 when processing stopped, then resumed later that day. This “halt and resume” pattern is notable because it reflects an operational tradeoff: pausing throughput can interrupt normal usage, but it can also reduce the chance that stolen funds continue to be moved before recovery tooling is ready.

How the exploit worked and where the flaw was

Qubic says the root cause was tied to predictable wallet seeds generated by vulnerable wallet software. Specifically, the issue affected seeds generated using Qubic’s web wallet on certain Apple devices and browsers, where an insecure random-number generator could result in seeds that were not sufficiently random.

That predictability created a pathway for an attacker to derive access to wallets whose seeds were generated under the flawed conditions. As a result, the project reported that approximately $1.4 million in QU tokens were drained from 1,404 accounts.

On Tuesday, Qubic urged users to treat affected wallets as insecure even if their balances were not moved. In its update, the team said that if a user created a wallet with the Qubic web wallet before version 4.26.4 (released Oct. 19), it should be considered unsafe.

Recovery and claims: what affected users should do

Qubic has launched a dedicated claims workflow for affected holders. The project points users to its reclaim platform where they can check their address and, if eligible, submit a claim. The platform is available at https://weak-seed-reclaim.qubic.org/.

Qubic states that claims can be submitted until May 1, 2027. That extended window matters because it gives users time to confirm whether their address is affected and complete the recovery process, rather than requiring an immediate response while details and eligibility tooling stabilize.

The team also emphasized immediate operational steps for security going forward: update and migrate. Qubic said it fixed the seed-generation flaw in the latest version of its web wallet, and it directed users to move funds to a new wallet after updating—while never using the old wallet again.

Wallet fix released in web wallet 4.26.4

Qubic states it resolved the underlying seed-generation issue in version 4.26.4 of its web wallet, which it released on Oct. 19. The project linked to its wallet repository for the fix and reiterated that the change is intended to prevent the generation of predictable seeds.

In the same update, Qubic’s guidance was straightforward: update to web wallet 4.26.4 or later, create a new wallet, transfer funds to the new wallet as soon as possible, and avoid using the older wallet. The practical implication for users is that recovery claims do not replace the need for better wallet hygiene—once a seed is generated under flawed conditions, the safer move is to retire that wallet and re-establish access using the patched generator.

Going forward, users should watch the status of the recovery process on Qubic’s network and confirm whether their address is eligible via the reclaim platform. The key open question is how comprehensively the recovery plan will address affected balances and whether the claim outcomes will be consistent across all impacted accounts as validators continue executing the post-incident recovery.