Qubic Opens Recovery Portal for 1,404 Wallets Drained in QU Seed Hack

Claims Portal Opens for 1,404 Affected Addresses

Qubic has opened a reclaim portal for holders whose wallets were drained in the October seed-generation incident, and affected users have until May 1, 2027 to file. The community tracking page qubicmap.org/check counts 1,404 affected addresses and roughly 2,939,606,531,944 QU taken in transfers on October 17 and 18, a tally built from on-chain movement rather than a company estimate. Dollar conversions circulated so far fall between about $1.3 million and $1.4 million; the spread comes from differing conversion times and price bases, and no official incident report has fixed a single verified figure yet.

The portal itself only registers applications and moves no funds. The Computor quorum, the network's consensus body, decides and executes each return, so a filed claim is not an automatic repayment. Claimants must supply the compromised source identity, a newly generated destination identity, a message signed with the source identity and supporting proof of ownership. Signatures alone cannot settle disputes, because an attacker who reproduces a compromised seed can produce the same valid signature, and the platform may therefore request exchange withdrawal receipts, private transaction records or a funding trail from another wallet the claimant demonstrably controls. Approved claims are published for seven days to allow objections, while contested filings stay in escrow until the dispute is resolved. Qubic announced the opening in a recovery update on X posted October 20, saying the first repayments have already reached verified owners, though the project has not disclosed how much was paid out or how many claims were approved. The team adds that it never asks for seeds or private keys, never sends direct messages first and charges no recovery fee, and it tells users to verify the portal address themselves before filing.

@_Qubic_ · X post

Recovery update on X.

View on X

Halt at Tick 85,371,949 and the 4.26.4 Patch

The chain stopped on October 18 at tick 85,371,949 and resumed processing on October 19, after operators froze transfers while the recovery proposal went to a quorum vote. Qubic's earlier security update ran from late on October 17 into early October 18 and estimated that 87.1% of the stolen tokens were still on the network when the halt took effect; the remaining 12.9% had reached exchange MEXC, which the project says froze the receiving account within roughly one hour. During the shutdown, affected funds sat in protected escrow ahead of repayment. The root cause sits in wallet software, not in the layer 1 blockchain protocol itself: insufficiently random seed generation made some recovery phrases predictable, and the public changes to the wallet code on GitHub replace Math.random() with crypto.getRandomValues(), showing exactly where the fix landed. A SlowMist analysis argued that six observations of the network could reconstruct keys under the old scheme, though neither the firm nor Qubic has confirmed that path as the actual attack vector. Other reporting pointed to predictable seeds created in browsers on older iPhones, iPads and Macs running Safari, rather than any flaw in the chain itself. Qubic's current instruction is blunt: any web wallet created before version 4.26.4, released October 19, should be treated as insecure even if the balance was never touched. Updating the app does not repair an old credential, so users must generate a new recovery phrase, the master credential of an HD wallet, and move any remaining funds to the fresh address. A full technical report on the incident is still pending.

Signatures Alone No Longer Prove Ownership

What stands out in the design is that Qubic has accepted the hard consequence of this exploit class: when an attacker can regenerate a seed, a signature stops being evidence of anything, so the portal leans on transaction history and human review instead of cryptography. That trade-off favors accuracy over speed, and the seven-day public window plus escrow for disputed claims should filter duplicate or fraudulent filings. The gaps are quantitative. Neither the returned amount nor the claim count has been published, and the promised full technical report has not landed, so the 87.1% on-chain share and the MEXC freeze remain the clearest map of where the stolen QU sits. Hardware wallets handle seed creation differently: a Ledger recovery key is generated on-device, and a Tangem mobile wallet keeps the process out of the browser entirely. Holders migrating old balances can follow how to recover a crypto wallet step by step before the May 2027 deadline.