Network Back Online After Emergency Shutdown
Qubic, a Layer-1 blockchain protocol, has resumed operations following a security incident that saw an attacker siphon approximately $1.4 million worth of QU tokens from 1,404 individual accounts. According to the project's most recent update, the network was back to processing transactions at 8:00 pm on October 19, pushing past tick 85,371,949 — the exact point where the chain had been frozen on Sunday in a bid to stop further theft.
The halt was triggered after investigators determined that the exploit stemmed from a weakness in how certain wallet seeds were generated. Attackers leveraged an insecure random-number generator embedded in Qubic's web wallet, which produced predictable seeds on specific Apple devices and browser configurations. Once the seeds could be forecast, the attacker was able to reconstruct private keys and sweep funds from the affected addresses.
Validators Approve Recovery Plan and Claims Deadline Set
Qubic's validator nodes, referred to within the ecosystem as Computors, voted in favor of a formal recovery framework. Under that framework, a dedicated reclaim platform has been made available so that affected holders can verify their address and file a compensation claim. The project has set a hard deadline of May 1, 2027, for all submissions.
In a statement issued on Tuesday, the Qubic team urged anyone who had created a wallet through the web interface prior to version 4.26.4 — released on October 19 — to consider that wallet compromised regardless of whether their balance had been touched. The team's guidance was explicit: upgrade to web wallet 4.26.4 or any later build, generate a fresh wallet, transfer remaining assets to the new address without delay, and permanently retire the old one.
The seed-generation defect itself was patched in the October 19 release, meaning newly created wallets on the updated client should no longer be vulnerable to the same predictability attack vector. However, Qubic stressed that the fix does not retroactively secure wallets that were already created under the flawed generator.
Broader Implications for Web-Based Wallet Security
The incident underscores a recurring risk in browser-based wallet implementations: reliance on the host environment's cryptographic randomness. When a random-number generator is not properly seeded or is subject to timing-based prediction, the resulting private keys become guessable, effectively handing control of the wallet to any observer who can model the generator's output.
For users across the broader crypto and decentralized-finance space, the Qubic episode serves as a reminder to verify that wallet software is running the latest patched version, to avoid creating keys on untrusted or outdated browser environments, and to treat any wallet generated before a known security patch as potentially compromised. Qubic's decision to halt the chain rather than allow continued theft, followed by a structured claims process, also highlights a governance model in which validator consensus can be mobilized quickly to protect the wider user base.
