Qubic’s latest core release expands a recovery system that can freeze listed wallets even when their funds have not been stolen, leaving legitimate owners unable to regain access without additional ownership checks and approval.
Recovery extends beyond stolen coins
The blockchain network’s October 21 core update introduced further changes to its frozen-address system. The design covers wallets affected by weakly generated secrets, including addresses whose assets remain untouched. According to CryptoSlate, the system is intended to protect funds before an attacker can remove them, but it also means that an owner of a vulnerable wallet may need to prove control before access is restored.
The underlying problem is that a weakly generated wallet secret may be reproducible. In that situation, both the original holder and an attacker could potentially create a valid signature from the same address. Qubic’s recovery process therefore treats a signature alone as insufficient evidence of ownership.
The October 19 v1.308.2 release describes two escrow operations. One moves drained QU from attacker identities, while the other moves QU and other assets from vulnerable wallets. The same release provides for freezing vulnerable identities, canceling their open QX orders and making tick 85,371,950 empty.
That intervention affects more than balances that have already been taken. Canceling an open order can interrupt a pending instruction, while the address-based freeze can restrict access to assets that remain available in the wallet. The mechanism uses a list of addresses: its lookup code loads identities, converts them into public keys and checks whether those keys belong to the listed set.
The distinction is important for affected holders. A wallet may have an unsafe secret, but the recovery system still depends on whether its address is included in the relevant list. Replacing the credentials requires generating a new seed; simply updating software does not change the secret already controlling an existing wallet.
Claims require evidence and collective approval
Applicants must provide a listed source identity, a secure destination, a signed message and additional evidence of ownership. Examples cited by the portal include exchange withdrawal records, earlier funding trails and signatures from unaffected funding addresses.
Core developers review the submissions, but the network’s computor quorum makes and applies the recovery decision. The website does not directly move funds. Didit identity verification is available as an optional part of the process.
Approved claims are not paid immediately. The relevant address and amount are publicly listed for seven days before payout. If competing claims remain unresolved, the funds stay frozen in escrow. The claim window is scheduled to remain open through May 1, 2027.
The recovery routes vary according to where the funds are held. Drained QU that remains on Qubic is assigned to escrow recovery. Funds sent to MEXC follow a separate exchange process described as slower and dependent on cooperation with law enforcement. Wallets that are vulnerable but have not been drained can be released after verification.
The published material does not provide a reconciled total for undrained balances or an independently verified total of completed repayments. As a result, the scale of the recovery cannot be established from the reviewed releases and claim rules.
Software fix does not repair an old wallet seed
Qubic’s v4.26.4 repository release, dated October 18, includes a change to the way replacement seeds are generated. The patch removes seed creation based on JavaScript’s Math.random in the create-vault and edit-seed flows.
A shared generator instead uses crypto.getRandomValues, rejects byte values that could bias letter selection and fails when secure randomness is unavailable. These changes are designed to improve the creation of new secrets. They do not rewrite the seed already attached to an existing wallet.
For that reason, installing the corrected software while continuing to use an old seed leaves the original credential unchanged. The recovery process directs affected users toward a newly generated secure destination rather than treating the software update alone as a completed fix.
The October 21 release also records additional frozen-address updates and sets an epoch 236 starting tick of 86,000,000. Qubic’s RPC endpoint reported epoch 236 at tick 86,154,732 during a review on October 22, beyond that starting point.
Moneyiar market picture
Moneyiar data at 23:34 on October 22, 2026, showed Qubic’s QUBIC token at $0.0000004132, down 4.37% over 24 hours and 22.61% over seven days.
For comparison, Nexus (NEX) was priced at $0.0000006019 at 23:33, down 10.62% in 24 hours and 19.28% over seven days. Walrus (WAL) stood at $0.0375568668, down 4.19% and 25.87% across the same periods, while FUNToken (FUN) was $0.0087078899, down 1.24% over 24 hours but up 6.75% over seven days.
Qubic’s recovery design illustrates the trade-off created when a blockchain responds to compromised wallet credentials at the protocol level. Freezing listed addresses can protect assets before they are taken, but legitimate holders may lose immediate control and must provide evidence before a secure replacement destination can receive the funds.
