Following the compromise of 1,404 Qubic wallets and the diversion of roughly 2.94 trillion QU on October 17–18, 2026, network processing has resumed and a recovery claims procedure is open. Beyond an operational restart, the case poses a fundamental self-custody ownership-proof problem.
Our initial technical investigation examined the inadequate seed generation and the official wallet patch. This follow-up focuses on recovery governance, supporting evidence and unresolved risks.
From emergency halt to claims
Qubic halted normal activity at tick 85,371,949 to restrict further transfers of the diverted funds. Explorer observations reported by Cointelegraph show ticks advancing again around 20:00 UTC on October 19.
On October 20, Qubic said its Computor quorum approved recovery arrangements. The team reported moving affected funds into protected escrow during the halt and said initial funds had been returned to verified owners. Neither the number of successful claims nor the total amount returned was established publicly in that announcement.
Affected users can check the official Qubic reclaim portal. The announced claims deadline is May 1, 2027. Opening a claims process does not guarantee approval or full recovery in any individual case.
Why a valid signature is not enough
Ordinarily, a valid wallet signature demonstrates control over a secret key. It does not establish the civil identity or rightful ownership of the person producing it.
Here, weak seed generation created a different threat: an attacker who reconstructed a vulnerable seed could produce a mathematically valid signature indistinguishable from one created by the rightful holder. Consequently, a signature from a compromised identity cannot be the sole proof of rightful ownership.
Recovery therefore has to consider evidence independent of that secret, such as historic wallet funding, exchange withdrawal records, documented transaction chronology, and other supporting records assessed by claims reviewers. Evaluating this evidence and handling competing claims requires a governance procedure, not merely a cryptographic check.
What the Computors' decision tells us
The announced quorum decision illustrates exceptional operational powers during a blockchain incident. Qubic Computors should not be treated as interchangeable with conventional Proof-of-Stake validators, but several audit questions carry across networks:
- Who can authorise a halt, escrow movement and restart?
- Where are decisions and execution traces recorded for public verification?
- How are disputed or competing claims resolved?
- What prevents an attacker with the same secret from claiming the rightful owner's assets?
Network restart, escrow protection and completed victim repayment are separate milestones. One should not be presented as proof of the others.
For an infrastructure operator such as Snow-Fall, the incident underscores the need for documented emergency authority, verifiable logs, well-understood operational dependencies and transparent governance.
What QU holders should do
Qubic advises users who created wallets with affected older web-wallet versions to treat those seeds as potentially unsafe, even if balances remain intact. Use wallet v4.26.4 or later, generate an entirely new wallet and seed, and follow official instructions for moving still-controlled assets.
Software updates cannot retroactively fix weak entropy in an existing seed. Changing a local password or importing the old seed again does not solve this issue. Never disclose a seed or enter it into a reclaim form: supporting ownership evidence must not expose private secrets.
See our guide to migrating a potentially compromised wallet and GLOV Secure.
Open questions as of October 21, 2026
The restart and recovery announcement are documented, but the available evidence does not establish that the entire incident has been resolved. Outstanding questions include:
- How much QU has demonstrably been returned, and to how many victims?
- Can complete quorum votes, recovery criteria and execution records be independently audited?
- How will competing or disputed claims be adjudicated?
- How much of the off-chain portion can eventually be recovered?
- Precisely how did the attacker reconstruct the vulnerable secrets?
Parts of the official reclaim portal still contain halt-era wording, which should not be read as a live network-status indicator.
The larger lesson: blockchain safety depends not just on sound signature mathematics, but also on secure key generation, credible ownership evidence and accountable emergency governance.
GLOV Secure / Snow-Fall analysis, based on information available October 21, 2026. Article dated October 22.