Qubic halted transaction processing after an attacker reportedly drained 1,404 wallets, putting the security of wallet-seed generation at the center of a network-wide recovery effort. The project has released a wallet patch, but a decision on the stolen funds remains separate from that software repair.
The project’s account, relayed in Sunday reporting, puts the theft at about 2.94 trillion QU. It attributes the incident to insufficient randomness when affected wallet secrets were created, rather than a flaw in Qubic’s transaction protocol. Those amounts and the incident’s scope remain project-reported findings, not an independently completed forensic assessment.
Qubic’s public RPC endpoint returned tick 85,371,949 during our Monday morning check, matching the point at which its validators, known as Computors, reportedly stopped the network. That observation is consistent with the announced halt; one endpoint is not a complete independent assessment of every network participant.
The repair changes how new secrets are generated
The official wallet repository provides a firmer view of the technical response. Version 4.26.4 includes a seed-generation fix, and its accompanying code replaces calls to JavaScript’s Math.random with the browser’s cryptographic random-number facility in the affected generation flows.
The change also rejects random byte values that would otherwise create an uneven distribution when converted into the wallet’s alphabet. If the secure browser facility is unavailable, the new implementation stops rather than silently falling back to the earlier generator.
These details matter because a seed is the secret from which control of a wallet is derived. A generator can produce something that looks random on screen while drawing from a much smaller or more predictable set of possibilities than intended. An attacker who can narrow that set may gain control without stealing a device or persuading its owner to approve a transfer.
A wallet update and recovery solve different problems
Repairing the generator protects the creation of new secrets. It does not retrospectively increase the randomness of a seed that already exists. Updating an application or changing an application password is therefore a different operation from replacing the underlying wallet secret.
That distinction is explained in our guide to wallet keys, backups and recovery. A password can protect access to software while the seed remains the ultimate means of recovering control of the assets.
The halt creates a second trade-off. Stopping processing can immobilize stolen tokens still on the network, but it also prevents legitimate holders from making normal transfers. A published software patch alone does not establish when those transfers can resume or what treatment the stolen balances will receive.
The next decision belongs to the network
Qubic has said the Computor quorum will determine a resolution. Until a recovery decision and a resumption are confirmed, frozen funds should not be described as returned to their owners, and the incident should not be treated as closed.
The immediate questions are whether the affected-address inventory is complete, how any recovery proposal treats legitimate balances, and when normal processing can safely restart. The code repair is tangible progress on the generator; those operational decisions will determine what the response means for holders.