SECURITY ALERT

The funds were frozen to keep them safe.

Now owners have to prove they are owners, to people who know the seeds were guessable.

Qubic said on Tuesday that its Computor quorum, the 676 validator seats that run the network, approved the recovery of wallets exposed by weak seeds, that a reclaim site is open and that the first funds have gone back to verified owners, in a thread on X posted at 18:14 UTC.

Claims are open until 1 May 2027, Qubic said.

The only official address is weak-seed-reclaim.qubic.org, according to the project. It says it will never send a direct message first or ask for a seed.

What a claim needs

The site asks for the affected identity, which must be on Qubic’s published list, and a brand-new destination identity created in web wallet 4.26.4 or later.

A signed message is required, but the site says it cannot prove ownership on its own: the attacker can sign with the same weak seed.

Ownership is decided by evidence the attacker would not have, reviewed by core developers. An exchange withdrawal receipt to the affected address is the strongest item, the site says.

So who counts as the owner of a guessable key?

What the chain shows

The escrow identity created by the restart, covered in Monday night’s alert on the restart and escrow, is:

XMGUNWJYLLUUZANFEWJNNIDMXNSDMPOVFAHWOERKDDAWDREZLANHTFJBKMPB

At 19:56 UTC it held about 2.86 trillion QU across 1,589 incoming transfers, with no outgoing transfer recorded, Qubic’s public RPC showed. On Monday it held about 2.84 trillion QU from 1,404 transfers.

Qubic has not said which account the first returns came from.

Two details do not line up. The reclaim site’s front page still says the network is halted. And Qubic’s thread dates web wallet 4.26.4 to 19 Oct, while GitHub shows the release on 18 Oct.

Which of the two is current?

Protect yourself

  • Use only weak-seed-reclaim.qubic.org; ignore any other “claim” link or direct message.
  • If you made a wallet in the Qubic web wallet before 4.26.4, treat it as insecure, create a new wallet and move your funds, Qubic says.
  • Never type a seed into a claim form; the site asks only for a signed message.
  • For why weak randomness breaks a seed, see SlowMist’s analysis of the weak seeds and what a private key is.

A technical report will follow, Qubic said. The first alert is the first alert on the halt.

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.