Qubic restarts, moves weak-seed wallets' QU to escrow

SECURITY ALERT

UPDATED 22:51 UTC, 20 Oct. Qubic said on Tuesday evening that its Computor quorum had approved the recovery of weak-seed wallets and opened a reclaim site, weak-seed-reclaim.qubic.org, with claims open until 1 May 2027. It also told anyone who created a wallet in its web wallet before version 4.26.4 to make a new one and move their funds. Our follow-up has the details.

UPDATED 03:53 UTC, 20 Oct. The chain kept moving overnight. Our reads of Qubic’s public RPC at 03:53 UTC showed tick 85,426,219, and its archive had processed ticks up to 85,386,031. The escrow still held about 2.84 trillion QU, and nothing had left it. Qubic’s official X account had posted nothing new.

The chain is moving again.

The coins are not where their owners left them.

Qubic’s core developers on Monday released node software that freezes 2,797 identities listed as weak-seed addresses and moves all of their QU and other assets into a single escrow address, according to release v1.308.2 on GitHub.

Nodes running the update were producing new ticks by about 20:12 UTC, our reads of Qubic’s public RPC show, after a halt that began on 18 Oct.

That escrow address held about 2.84 trillion QU at our read, received in 1,404 transfers at tick 85,371,950.

That is roughly $1.4 million at CoinGecko’s QUBIC price at 20:12 UTC, by our arithmetic.

None of it has been returned to anyone yet.

The timeline, in UTC

17 Oct, 23:42 to 18 Oct, 01:26. An attacker drains 1,404 wallets of about 2.94 trillion QU, Qubic says. Our Monday morning’s alert on the halt has the detail.
18 Oct. Computors halt the network at tick 85,371,949.
19 Oct, 17:48. The v1.308.2 pull request is merged; the release is published at 17:53.
19 Oct, about 20:12. Upgraded nodes report tick 85,372,048, then 85,372,477 two minutes later.

What does the new code actually do?

What the release changes

The release notes list five steps.

Tick 85,371,950 is forced empty, so no transaction can land in it. Open orders on the QX exchange contract from frozen identities are cancelled.

Then comes the sweep.

The code reads a list of 2,797 identities, described in the file header as “weak-seed addresses frozen” from that tick onward. In tick 85,371,950 it moves all of their QU, and the asset shares they own, to one escrow identity, defined in the node settings as “XMGUNW…KMPB”.

After that, any transaction signed by a frozen identity is dropped.

The release notes cover both the “attacker’s identities” and “vulnerable wallets”. In other words, wallets that were exposed but never drained have been swept too.

Put simply, the seed a user still holds no longer controls those coins.

Why move coins that nobody stole?

Frozen, escrowed, not returned

Qubic said on Sunday that 87.1% of the drained QU, about 2.56 trillion, never left the network. MEXC froze the other 12.9%.

The escrow now holds about 2.84 trillion.

The gap of roughly 280 billion QU is our arithmetic. The release notes suggest it comes from balances in exposed wallets that were swept before anyone could drain them, but Qubic has not published a breakdown.

The release also removes the QLoan contract; the commit says the proposal was rejected.

Qubic’s token was up about 18% over 24 hours at $0.000000497 on CoinGecko at 20:12 UTC, with a market value of about $71.3 million.

So who gets the escrow, and when?

What we do not know

How owners of swept wallets will prove ownership and reclaim their QU, and on what timetable.
Whether all Computors have upgraded. At 20:14 UTC on Monday some nodes behind the RPC still reported the halt tick; by 03:53 UTC on Tuesday every read we made showed the new chain, and the archive was catching up.
Whether MEXC and other exchanges have reopened QUBIC deposits and withdrawals.
How the 2,797 identities were chosen, and whether more weak seeds will be added.

Qubic’s official X account has posted nothing since its Sunday statement.

Protect yourself

If your Qubic seed was made on an iPhone or iPad, in Safari on a Mac before 18 Oct, or in the Qubic iOS app before July 2025, assume it may be on the frozen list. Wait for Qubic’s official channels before sending anything from it.
Do not send new QU to an old affected address. From tick 85,371,950 the network drops transactions from frozen identities.
Make any new seed in Qubic wallet 4.26.4 or later.
Nobody legitimate will ask for your seed to “release” escrowed funds. Treat any such message as a scam (why the recovery phrase is the master key).

When a chain can move coins out of a key holder’s address, who decides who owns them?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.