Qubic has restarted its network and launched a recovery process after a wallet seed vulnerability let an attacker drain roughly $1.4 million in QU tokens from 1,404 accounts, according to the project. The explorer shows the network resumed processing ticks at 8:00 pm on Oct. 19, past tick 85,371,949, where it had halted on Sunday. In a post on X, Qubic said the Computor quorum approved the recovery and the first funds had gone back to verified owners. The announcement gave no amount for those first returns.
The Qubic network is live again.
— Qubic (@_Qubic_) October 20, 2026
The Computor quorum approved the recovery, the reclaim platform is open, and the first funds have already gone back to verified owners.
Here's what's new and what you need to do. pic.twitter.com/2pIM0IfiFB
Why the seeds were predictable
The halt came after attackers exploited seeds produced by vulnerable wallet software. The affected seeds came from Qubic's web wallet on certain Apple devices and browsers, where an insecure random-number generator could produce predictable results.
Qubic listed the exposed environments as any browser on an iPhone or iPad and Safari on a Mac before Oct. 18, plus the Qubic iOS app before July 2025. The project said the attacker emptied the wallets between 23:42 UTC on Oct. 17 and 01:26 UTC on Oct. 18, a window of 104 minutes. The root cause is JavaScript's Math.random(), not a protocol bug. The patch in version 4.26.4 switched seed creation to crypto.getRandomValues(). The core protocol and QEARN staking were not affected.
Seeds are affected if they were created:
— Qubic (@_Qubic_) October 18, 2026
On an iPhone or iPad, in any browser, before 18 October 2026
⁰On a Mac using Safari, before 18 October 2026
⁰In the Qubic iOS app, before July 2025
Escrow and the MEXC share
Of the total drained, 87.1% never left the Qubic network, and the Computors' halt locked it in place. The other 12.9% went to MEXC. MEXC froze the receiving account about an hour after the transfer.
Qubic said the affected funds sat in a protected escrow while the network was halted. That step made the recovery possible, according to the project.
The reclaim portal handles the two pools differently. Funds still on Qubic return from the recovery escrow, while the MEXC share follows a slower route that depends on law-enforcement cooperation. Wallets whose funds were never drained are released from an on-hold list after verification.
The claim window is open until May 1, 2027, and Qubic says claims with clear evidence move fastest.
What wallet owners should do
Qubic's advice is blunt. Any wallet created with the web wallet before version 4.26.4 should be treated as insecure, even if its funds were never touched. The team wrote:
"Update to web wallet 4.26.4 or later, then create a new wallet," and then move funds across and stop using the old seed.
An earlier community notice said previously generated weak seeds remained a concern, including those tied to addresses absent from the recorded theft list. That is why the project wants migration even from wallets that were not drained.
The only official reclaim site is weak-seed-reclaim.qubic.org. Qubic warns that it will never start a direct message or ask for a seed. The team is on Discord to help with claims, and it says a full technical report will follow.
Questions the restart leaves open
Investinglive argued that the freeze saved most of the stolen tokens but showed how much power a small validator group holds over users' funds. That is one reading of a halt that the quorum itself later approved.
The token fell more than 10% after the halt, according to CoinMarketCap data. MEXC and Bitget suspended QUBIC deposits and withdrawals. Qubic has also not said how much has been returned or how many claims it has approved.
Matvii Diadkov
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Cryptocurrency investments involve significant risk of loss. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
