Layer-1 blockchain Qubic restarted its network and launched a recovery claims platform after an attacker drained approximately $1.4 million in QU tokens from 1,404 accounts. The exploit stemmed from predictable wallet seeds generated by the project's web wallet on certain Apple devices and browsers due to an insecure random-number generator.
Qubic's network validators, known as Computors, approved the recovery plan. The network resumed processing ticks at 8:00 p.m. on Oct. 19, advancing the chain beyond tick 85,371,949, where it had been halted to prevent further movement of stolen funds.
The project released a patched web wallet version 4.26.4 on Oct. 19 and issued a direct warning to users: "If you created your wallet with the Qubic web wallet before version 4.26.4 (released 19 October), treat it as insecure, even if your funds were never touched."
Affected users must update to version 4.26.4 or later, create a new wallet, and transfer funds to the secure address. Old vulnerable wallets should not be used again. Users can verify eligibility on Qubic's reclaim platform, with claims accepted through May 1, 2027.
