Layer-1 blockchain Qubic has restarted its network and initiated a recovery process following a security breach that resulted in the loss of approximately $1.4 million in QU tokens from 1,404 accounts. The incident stemmed from a vulnerability in wallet seed generation, specifically affecting users who created wallets via Qubic’s web interface on certain Apple devices and browsers where an insecure random-number generator produced predictable seeds.
The network was halted on Sunday to prevent further unauthorized movement of funds. According to project updates, validators known as Computors approved a recovery plan, and the blockchain explorer confirmed that the network resumed processing ticks at 8:00 pm on October 19, advancing beyond tick 85,371,949. To facilitate restitution, Qubic launched a claims platform for affected wallet holders, allowing them to verify their addresses and submit claims until May 1, 2027.
Qubic addressed the root cause by releasing version 4.26.4 of its web wallet on October 19, which fixed the seed-generation flaw. The team issued a stark warning to all users who created wallets prior to this update, advising them to treat those credentials as insecure regardless of whether their funds were directly targeted. Users are instructed to update to the latest version, create new wallets, and immediately migrate assets to the secure environment while permanently abandoning the old ones.
This incident highlights the critical operational risks associated with client-side cryptographic implementations, particularly when relying on device-specific random number generators. By halting the chain and coordinating validator consensus for a recovery plan, Qubic demonstrated a centralized intervention capability that contrasts with typical decentralized immutability principles. This approach prioritizes asset preservation over strict protocol neutrality, setting a precedent for how Layer-1 networks might handle large-scale thefts caused by software vulnerabilities rather than consensus failures.
The mandatory migration directive for pre-version 4.26.4 users underscores the severity of the entropy failure, implying that even untouched accounts remain vulnerable to future exploitation if the underlying seed logic is compromised. Stakeholders should monitor the uptake of the claims platform and the speed of user migration, as these metrics will indicate community trust in the recovery mechanism. Furthermore, the reliance on a specific deadline (May 1, 2027) introduces administrative complexity, requiring robust verification processes to prevent fraudulent claims during the restitution window.
