$1.4M Qubic Hack Victims Have Until 2027 to Reclaim Stolen Tokens

TLDR

• Qubic’s layer-1 blockchain has resumed operations following an exploit that siphoned approximately $1.4 million worth of QU tokens from 1,404 user wallets.
• Network validators known as Computors voted to approve a fund recovery mechanism, with some verified victims already receiving reimbursements.
• The breach stemmed from compromised wallet seeds generated by Qubic’s web interface on select Apple hardware and browser configurations.
• All users who generated web wallets prior to version 4.26.4 are instructed to migrate to new addresses immediately, regardless of whether they experienced losses.
• Impacted token holders have until May 1, 2027, to submit reimbursement requests via Qubic’s designated reclaim portal.

Qubic has brought its layer-1 blockchain back online and initiated a fund recovery process following a security incident that resulted in losses totaling approximately $1.4 million.

The exploit saw an attacker extract roughly 2.94 trillion QU tokens across 1,404 user accounts. Victims now have a window extending to May 1, 2027, to submit reimbursement claims.

Network Validators Green-Light Fund Recovery Mechanism

In an October 20 announcement on X, Qubic confirmed that its Computors—the network’s consensus validators—had ratified a recovery framework.

The development team disclosed that preliminary fund distributions have begun reaching verified account holders. Specific figures regarding disbursement amounts and the number of approved claims were not disclosed.

The security breach occurred during the overnight hours spanning October 17 and October 18. Qubic suspended blockchain operations on Sunday, October 18, at tick 85,371,949 to prevent further movement of compromised assets.

Data from Qubic’s blockchain explorer, as referenced by Cointelegraph, indicates the network recommenced transaction processing at 8:00 pm on October 19. Crypto.news was unable to independently verify the precise restart timestamp.

Qubic’s analysis determined that 87.1% of the stolen tokens remained on-chain when operations ceased. The remaining 12.9% had been transferred to the MEXC cryptocurrency exchange, which froze the recipient account within approximately 60 minutes.

During the network suspension, compromised funds were relocated to a protected escrow mechanism. This infrastructure enables the team to process verified reimbursement requests.

Legacy Qubic Wallet Seeds Pose Ongoing Security Risk

The vulnerability centered on wallet seed generation methodology rather than any flaw in the blockchain’s consensus architecture. The web-based wallet employed an inadequate random number generator on certain devices, rendering some recovery phrases mathematically predictable.

Vulnerable seeds encompass those generated via browsers on iPhones and iPads, through Safari on macOS systems, and within earlier iterations of Qubic’s iOS application.

Qubic remediated the flaw in web wallet version 4.26.4, deployed on October 19. However, software updates cannot retroactively secure recovery phrases generated using compromised versions.

“If you created your wallet with the Qubic web wallet before version 4.26.4 (released 19 October), treat it as insecure, even if your funds were never touched,” the team stated on Tuesday.

“Update to web wallet 4.26.4 or later, then create a new wallet,” the team continued. “Move your funds to the new wallet as soon as you can, and never use the old one again.”

Through Qubic’s reclaim portal, users can verify an address, file a claim, and monitor processing status. Claimants must provide their compromised identity, a new destination identity, a cryptographically signed message, and ownership verification materials.

The platform emphasizes that wallet signatures alone are insufficient. An attacker capable of reconstructing a weak seed could generate identical valid signatures.

Acceptable supporting documentation includes exchange withdrawal confirmations, private transaction logs, or a traceable funding path from another wallet under the claimant’s control. Identity verification remains optional.

Qubic cautioned users about fraudulent actors offering assistance via direct messages. The team emphasized it will never request recovery phrases or initiate unsolicited contact regarding claims.

Comparable seed generation vulnerabilities have emerged in other wallet implementations, including a Coldcard firmware defect disclosed in July 2026 and the 2023 Libbitcoin Explorer vulnerability.

Qubic announced plans to release a comprehensive technical post-mortem on the incident. The claims submission window remains open through May 1, 2027.