Overview
- Qubic said an attacker used predictable recovery seeds to drain about 2.94 trillion QU from 1,404 wallets in an exploit that took place between October 17 and October 18.
- The project halted the layer-1 chain at tick 85,371,949, moved affected on-chain funds into protected escrow, and resumed processing after its validator quorum approved a recovery plan.
- Qubic estimated 87.1% of the stolen QU remained on-chain when it stopped and said the remaining 12.9% reached exchange MEXC, which froze the receiving account within about an hour.
- The reclaim portal is open with a May 1, 2027 deadline and requires claimants to supply the compromised source identity, a new destination identity, a signed message and independent proof of ownership beyond wallet signatures.
- Qubic released web wallet v4.26.4 to fix the insecure random-number generator but warned that any recovery phrase created before that release remains vulnerable and must be replaced by generating a new wallet and transferring funds.