Qubic’s recovery rules require ownership checks even for unstolen funds in vulnerable wallets

Qubic's recovery rules can leave the owner of a vulnerable wallet needing approval to regain access even when its funds were never stolen. The blockchain network's October 21 core update adds further frozen-address changes to a design that reaches beyond coins already taken by an attacker.

The incident involved weakly generated wallet secrets that an attacker could reproduce. Both the attacker and the original holder can then produce a valid signature. Qubic's reclaim rules therefore require evidence beyond that signature before a claim is approved.

How the freeze changes access

The October 19 v1.308.2 release specifies two distinct escrow operations: moving drained QU from attacker identities and moving QU and assets from vulnerable wallets. It also specifies freezing vulnerable identities, canceling their open QX orders and making tick 85,371,950 empty.

That is a broader intervention than tracing coins after theft. Its stated scope includes securing assets before an attacker has removed them. Canceling an open order also interrupts an existing pending instruction, so the recovery design reaches open orders as well as a freely available QU balance.

The scope is address based. The release's frozen-address lookup code loads identities from a list, converts them to public keys and checks whether a public key belongs to that set.

This distinction separates two questions a holder faces: whether the wallet secret is unsafe and whether the address falls within the recovery mechanism. The published freeze mechanism depends on the address list, while secure replacement credentials require a new seed.

The October 21 release keeps the address restrictions a current issue. Its notes specify more frozen-address updates and an epoch 236 starting tick of 86,000,000.

Applicants must provide a listed source identity, a secure new destination, a signed message and ownership evidence. The portal names exchange withdrawal records, earlier funding trails and signatures from unaffected funding addresses as examples. Core developers review that evidence; the network's computor quorum decides and applies recovery. The website itself moves no funds.

Didit identity verification is optional. The claim window runs through May 1, 2027. Under the published process, approved addresses and amounts appear for seven days before payout, while unresolved competing claims remain frozen in escrow.

CryptoSlate's September 24 Coldcard recovery coverage described a related ownership problem: a public-address match began a claim, with checks still required before a return. Qubic's published core changes add a protocol-level freeze of listed identities.

A wallet fix does not finish the recovery

The wallet fix addresses how replacement secrets are created. Qubic's v4.26.4 repository release is dated October 18 and includes the secure seed-generation change.

The linked patch replaces seed creation based on JavaScript's Math.random in both the create-vault and edit-seed flows. A shared generator uses crypto.getRandomValues, rejects byte values that would bias the letter selection and fails if secure randomness is unavailable.

Those changes improve the process used to generate a new seed. They do not rewrite the secret controlling an existing wallet. Installing corrected software while retaining the old seed leaves that credential unchanged, which is why a secure replacement identity requires a newly generated secret.

Qubic's RPC endpoint reported epoch 236 at tick 86,154,732 during this review on October 22, beyond the release's 86,000,000 starting point. Qubic's documentation identifies the endpoint as a source of current tick information.

The recovery routes also differ. The portal assigns drained QU still on Qubic to escrow recovery, MEXC-bound funds to a separate exchange process that it says is slower and depends on law-enforcement cooperation, and weak-but-undrained wallets to release after verification.

The reviewed releases, claim rules and tick snapshots provide no reconciled undrained-balance total or independently verified completed-repayment total.

For affected holders, the consequential measure is restored access to a secure destination. Qubic's published design can protect listed balances from a compromised key while making their release depend on evidence and collective authorization.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.