Qubic Brings Blockchain Back Online After $1.4 Million Attack, Sets Recovery Claim Window

Qubic has relaunched its layer-1 blockchain and started refunding the users of verified wallets following the discovery of the vulnerability in the seed generation process that led to the theft of about $1.4 million (roughly Rs. 13.2 crore) worth of QU tokens from 1,404 accounts. Qubic claimed in an October 20 recovery update on X that its Computor quorum had agreed to the recovery plans, which would allow the network to return to normal operations and initiate the claims process. The first payment had already been made, but the amount paid was not revealed, nor was it stated how many claims were approved. 

Qubic Attributes Wallet Breach to Weak Recovery Seed Randomisation

Operations within the chain were resumed following a stoppage initiated on October 18 to stop further theft of tokens from being carried out. Users affected have until May 1, 2027, to make their claims on the recovery platform. The attack took place during the period from late October 17 to early October 18, as per Qubic's previous security update. The hacker managed to access the wallets created using non-random recovery seeds and stole around 2.94 trillion QU.

The Qubic blockchain was halted at tick 85,371,949. The halt allowed for the necessary time for transfers to be restricted until the team conducted an investigation into the affected addresses and came up with a solution for the Computors. According to the project's calculations, 87.1 percent of the tokens were still present in the network when it was shut down. Meanwhile, 12.9 percent of the tokens had made their way to the crypto exchange MEXC, whose company stated that it froze the recipient's account in about an hour.

The issue arose from a vulnerability in the generation of the wallet seed rather than from the claimed problem with the blockchain's consensus protocol. Lack of sufficient randomness made the recovery phrases predictable, enabling the attacker to recover credentials of the compromised accounts. The first announcement about Qubic's problem mentioned seeds generated by browsers on iPhones and iPads, by Safari on Mac machines, and by earlier versions of their iOS application.

Qubic officially stores its wallet code on GitHub and claims that version 4.26.4 solved the issue with seed generation. Nevertheless, updating the application will not change the recovery phrase created by the vulnerable software. It is essential that users update the wallet, create a brand new recovery phrase, and move all their funds to the new address. Otherwise, using the old seed will mean that they will remain vulnerable.