Is My Pre-4.26.4 Qubic Wallet Unsafe? Recovery After the Network Restart

Treat any Qubic Web Wallet created before version 4.26.4 as insecure; generate a new seed and move remaining funds to a new destination identity. QUBIC at WEEX: “Listed” — in a first-hand check on 19 October 2026 (27 Mehr 1405), the token page showed that label and the spot market page had no live price; those pages alone do not show whether orders, deposits or withdrawals work. crypto.news reported on 21 October 2026 (29 Mehr 1405) that Qubic said the network was live again and its Computors approved the recovery by reaching quorum.

What a “weak seed” means, and where Qubic put the cause

A seed is a secret string that works like a wallet password; anyone who has it can access that wallet’s assets. Qubic Docs, “How to Invest in Qubic” (no publication date; page state as of 19 October 2026 / 27 Mehr 1405, Qubic Docs), describes the seed as 55 characters and warns never to share it.

Weak randomness concerns the process that builds that secret string: when the values used to produce a seed are too predictable, an attacker may be able to guess or reconstruct likely seeds. In its security update of 18 October 2026 (26 Mehr 1405), Qubic named this as the cause and said the issue sat in seed generation, not in the Qubic protocol itself (Qubic’s 18 October 2026 security update). A more detailed technical account, including how the random value was produced, belongs to a technical write-up Qubic promised and has not yet published.

Which wallets fall inside Qubic's stated scope

Qubic named three seed-creation combinations in its security update of 18 October 2026 (26 Mehr 1405): any browser on iPhone or iPad before 18 October 2026 (26 Mehr 1405); Safari on Mac before that same date; and the Qubic iOS app before July 2025 (Tir 1404) (Qubic’s security update).

That list is Qubic's own announced scope, not a clearance for everything else. A wallet created outside the three combinations is not thereby shown to be safe, and if you are unsure of the creation date, device or browser, treat it as undecided rather than risk-free.

The attack window and the figures Qubic published

According to Qubic’s security update of 18 October 2026 (26 Mehr 1405), the attack ran from 23:42 UTC on 17 October 2026 (25 Mehr 1405) to 01:26 UTC on 18 October 2026 (26 Mehr 1405), draining roughly 1,404 wallets of about 2.94 trillion QU (Qubic’s security update). These are the project’s own figures, given here as token amounts in QU.

In its security update of 18 October 2026 (26 Mehr 1405), Qubic said Computors coordinated a protective network halt at tick 85,371,949 and that no transactions were processing when it published the update; the aim was to prevent drained funds from being moved or sold while the matter was examined (Qubic’s 18 October 2026 security update).

Qubic said in its 20 October 2026 (28 Mehr 1405) announcement that the network was live again; crypto.news quoted that statement on 21 October 2026 (29 Mehr 1405). However, Qubic’s reclaim portal still says, “The network is halted and the funds are frozen,” and gives no update date; that wording does not match Qubic’s 20 October 2026 (28 Mehr 1405) announcement as quoted by crypto.news on 21 October 2026 (29 Mehr 1405) (Qubic reclaim portal; crypto.news report). A restart alone does not establish that an old identity or seed is safe.

New warning for older web wallets

Qubic fixed seed generation in version 4.26.4; its official wallet release page dates that release to 18 October 2026 (26 Mehr 1405) and notes cryptographically secure generation. crypto.news on 21 October 2026 (29 Mehr 1405) quotes Qubic’s advice as giving 19 October 2026 (27 Mehr 1405) as the release date; the dates differ. The advice is to treat any wallet created with Qubic Web Wallet before 4.26.4 as insecure, even if untouched, create a new seed and move remaining funds to a new destination identity (crypto.news report, 21 October 2026).

“Frozen” is not “returned”

In its 21 October 2026 (29 Mehr 1405) report, crypto.news quoted Qubic’s 18 October update as saying that 87.1% of drained funds remained frozen on Qubic and 12.9% went to MEXC; Qubic said the receiving account was frozen about an hour later. These are the project’s figures (crypto.news report).

“Frozen” does not mean returned or available to victims. Qubic reclaim portal says funds sent to MEXC are returned via the exchange, separately and more slowly, depending on law-enforcement cooperation (Qubic reclaim portal).

Qubic said in its 20 October 2026 (28 Mehr 1405) announcement that the Computors approved recovery by reaching quorum, the network was live again and the first funds had reached verified owners. crypto.news reported on 21 October 2026 (29 Mehr 1405) that Qubic disclosed neither the amount repaid nor the number of approved claims (crypto.news report; Qubic’s X announcement).

What a recovery claim requires

Qubic reclaim portal requires an affected source identity, a new destination identity, a signed message and evidence of ownership; a signature from the affected seed alone cannot establish ownership. Claims are open through 1 May 2027 (Qubic reclaim portal).

1. Source identity: the affected 60-character identity, which must appear on the published affected-address list.
2. New destination identity: generate a fresh seed in an updated wallet, version 4.26.4 or later, and not on an affected device or browser; never reuse the affected seed.
3. Signed message and ownership evidence: sign the portal’s exact message with the source identity, but never enter a seed. Examples of evidence include an exchange withdrawal receipt, an OTC deal confirmation, a pre-incident funding trail, or a signature from another address that funded the affected one. The portal says the affected identity’s signature alone is insufficient because an attacker may produce the same valid signature.

Claim timing and impersonation warnings

• Never enter or share a seed, private key, account password or one-time code on any website, checker, direct message or recovery form.
• Qubic reclaim portal says the team will never initiate a direct message, ask for a seed or charge a recovery fee; the portal itself never asks for a seed (Qubic reclaim portal).
• Claims remain open through 1 May 2027. Optional identity verification through Didit is available, but does not replace ownership evidence (Qubic reclaim portal).
• The portal says approved claims are listed (address and amount only) for 7 days before payout; unresolved competing claims stay frozen in escrow (Qubic reclaim portal).

The portal says ownership is assessed from evidence, and disputes may extend the process.

Frequently asked questions

If my wallet was created outside the three combinations, is it safe?

No; it means your wallet was not on Qubic's list, not that its safety has been confirmed. If you are unsure of the creation date, device or browser, treat it as undecided.

Does updating to 4.26.4 bring back lost funds?

No. The version fixes the seed generator for future creations and has no effect on a seed created earlier.

What is the deadline for Qubic recovery claims?

The deadline for filing is 1 May 2027; submitting a form alone does not guarantee acceptance or payment (Qubic reclaim portal).

Published: 28 Mehr 1405 (20 October 2026) · Updated: 29 Mehr 1405 (21 October 2026) · Published by WEEX · WEEX Learn

This article is general information and is not investment advice.