In this article5 sections
Qubic restarted its layer-1 blockchain at 8:00 pm on Oct. 19, resuming past tick 85,371,949, the point where the network had been halted, Cointelegraph reported. The restart followed a seed-generation flaw that let an attacker drain roughly $1.4 million in QU tokens from 1,404 accounts.
The project’s validators, called Computors, approved a recovery plan, and Qubic opened a claims platform where affected holders can check their address and file for reimbursement. The filing window runs until May 1, 2027, according to Cointelegraph.
Also read: Bitget Raises Hack Estimate to $387.5M as Withdrawals Return
Key facts
- The attacker took about 2.94 trillion QU from 1,404 wallets between 23:42 UTC on Oct. 17 and 01:26 UTC on Oct. 18, 2026, per Qubic’s incident post.
- The network was halted at tick 85,371,949 and resumed processing on the evening of Oct. 19.
- Cointelegraph reported that the flaw affected seeds generated by Qubic’s web wallet on certain Apple devices and browsers using an insecure random-number generator, and that Qubic said the issue was fixed in web wallet version 4.26.4.
- Blockonomi and Coincentral reported that 87.1% of the stolen funds, about 2.56 trillion tokens, remain frozen on the network, and that MEXC froze the account holding the remainder within about an hour.
- Qubic told users that wallets created before web wallet 4.26.4 should be treated as insecure even if they were never touched, and urged holders to move funds to a new wallet.
How the seed flaw worked
Recovery seeds generate the private keys that control a wallet, and weak randomness makes them easier to guess. Blockonomi reported that the fix replaced JavaScript’s Math.random() function with crypto.getRandomValues(), a change visible in a GitHub update, but that it covers only new seeds; Qubic has not said older recovery phrases are safe.
Affected seeds include those made in any browser on an iPhone or iPad before Oct. 18, 2026, in Safari on a Mac before that date, and in the Qubic iOS app before July 2025, according to Blockonomi and Coincentral. The fault sat in the wallet software rather than the blockchain protocol.
Also read: Ledger Probes $86M Theft as CZ Flags Supply Chain Attack
Frozen funds and the shape of the recovery
Blockonomi and Coincentral both put the frozen share of stolen tokens at about 2.56 trillion, with roughly 379.26 billion tokens, or 12.9%, sent to MEXC. The exchange suspended Qubic deposits and withdrawals at the project’s request, and XT paused deposits and withdrawals on the Qubic and Kasplex networks on Oct. 18, citing wallet upgrades.
Qubic has not confirmed that any stolen tokens have been returned. It also has not said whether recovery will reverse transfers or compensate users another way. The reports describe the claims platform as the mechanism for affected holders, while the disposition of frozen funds still depends on the Computors’ plan.
Why it matters
Qubic is a fee-free layer-1 that uses Useful Proof of Work, directing mining power toward AI training, with a token market value of about $62.6 million according to CoinGecko. The incident shows that a wallet’s random-number source can defeat a chain’s own security, and the frozen majority means most holders’ losses hinge on how validators handle funds still on the network. Similar seed weaknesses hit Coldcard, Trust Wallet and Libbitcoin Explorer, and AMLBot’s 2026 report found hacks made up 19% of third-quarter crypto crime cases but 40% of reported losses.
What to watch
The May 1, 2027 claims deadline is the fixed date for affected users. Qubic has said it will publish a full technical report once the recovery plan is settled, which should clarify how frozen tokens are handled.
Reported by cointelegraph.com.
Sources: Cointelegraph, Blockonomi, Coincentral