Qubic opens claims portal after wallet seed flaw exposes 1,404 accounts

Qubic is now officially live again. The team has initiated their recovery process following the recent seed vulnerability that drained $1.4M in QU across 1.4k wallets. To support affected users, the platform has introduced a claims portal where impacted wallet holders can submit their requests.

According to Qubic Explorer, the blockchain resumed tick processing at 20:00 UTC on October 19. The network is now processing transactions past tick 85,371,949, following the emergency shutdown on Sunday.

Qubic’s claim portal is open till May next year

Qubic encouraged affected users to submit claims to restore their funds to their secure identities. The Qubic team explained that the computor quorum will be responsible for all decisions related to recovery and for implementing such actions. Users have until May 1, 2027, to submit claims. 

The platform guaranteed users that when the blockchain network was unavailable, their funds were transferred to a secure escrow wallet. Such a transfer has become the basis for successful recovery. Nevertheless, the project warns that any web wallet created before the October 19 version 4.26.4 update is not secure. 

It is vital to update your wallet, transfer all your assets to the new secure address, and stop using old wallets altogether, it said.

Primarily, the attacker made away with 2.94 trillion QU from 1,404 wallets. According to the network, the hack resulted from a weakness in seed generation, rather than the Qubic protocol itself.

It wrote, “The incident happened because these seeds are weak. That means the attacker can produce the same valid signature you can.” Though it has now confirmed that the seed-generation flaw had been addressed in the latest version of its web wallet.

Similarly, past security breaches have repeatedly shown that flaws in randomness generation can leave crypto wallets vulnerable to attacks. In particular, in late July, hackers exploited a firmware configuration vulnerability in Coinkite’s Coldcard, traced back to March 2021, to steal Bitcoin from users. 

The hacking was done in four separate waves of fraudulent transactions. It started on July 30, 2026, when the hacker stole 594 BTC, almost $38 million, in just 25 minutes. Primarily, the security threat exploited a weakness in the hardware entropy generation of the affected crypto wallets.

Specifically, a bug in Coldcard firmware version 4.0.1, which was released in March 2021, broke the algorithm for generating the seed, leading to the formation of a recovery phrase with low entropy. As a result, the wallet configured with that firmware generated weak private keys, which could be easily cracked offline.

The flaw in the setup design led to a complete breakdown of cryptographic security, reducing the key space from 128 bits to just 40 bits on outdated hardware. According to research by Galaxy, the total number of losses stands at roughly 1,816 BTC, totaling almost $116 million USD, and 5,200 different addresses were used.

September saw two major crypto exploits

Blockchain security firm PeckShield documented 55 major exploits in September, with aggregate losses nearing $766.5 million. This represents a 462% increase compared to August’s total of $136.3 million. The bulk of losses came from the Bitget exchange hack (worth $387 million) and the Liquid Network breach (worth $320 million). Nevertheless, Liquid saw a $285 million return.

According to Gracy Chen, the CEO of Bitget, the attack resulted from an attacker manipulating backend transaction data to bypass the authorization process. The company will pay for the damage itself from the User Protection Fund, which has a balance exceeding $464 million. As for the Liquid Network incident, 4,000 BTC were withdrawn illegally.

The Qubic incident adds to a growing list of security failures affecting crypto users, exchanges, and wallet providers. Although the causes and scale of these breaches vary, they highlight the importance of secure key generation, rapid incident response, and transparent recovery procedures.

For Qubic, the immediate priority is to process claims while ensuring users migrate to secure wallet identities. The outcome of that process will determine how much of the stolen value can be recovered and how effectively the network restores user confidence.