Analysis: Qubic recovery rules require ownership checks even for unstolen funds

Qubic's recovery process can restrict access to vulnerable wallets even when an attacker has not taken the funds. Weakly generated wallet secrets can be reproduced by an attacker, allowing both the attacker and the original holder to sign valid transactions. Qubic therefore requires additional ownership evidence before approving recovery claims.

The October 19 v1.308.2 release specifies separate escrow operations for drained QU held by attacker identities and for QU and assets held in vulnerable wallets. The release also specifies freezing vulnerable identities and canceling open QX orders associated with those identities. The release requires tick 85,371,950 to be empty. The intervention covers assets that an attacker has not yet removed. Canceling open orders interrupts pending instructions, extending the recovery mechanism beyond available QU balances.

The frozen-address lookup code reads identities from a list, converts those identities into public keys and checks public keys against that set. Inclusion in the address list determines whether the published freeze mechanism applies, separately from whether a wallet secret is unsafe. The October 21 core release specifies additional frozen-address changes. The release also sets the starting tick for epoch 236 at 86,000,000.

Applicants must provide a source identity on the list, a secure new destination, a signed message and evidence of ownership. The portal lists exchange withdrawal records, previous funding trails and signatures from unaffected funding addresses as possible evidence. Core developers assess the evidence. The network's computor quorum authorizes and implements recovery. The website does not transfer funds.

Didit identity verification is not mandatory. Applicants have until May 1, 2027, to submit claims. The published process requires approved addresses and amounts to be publicly listed for seven days before payment. Unresolved competing claims stay frozen in escrow.

Qubic's v4.26.4 wallet repository release, dated October 18, includes a change to secure seed generation. The linked patch replaces JavaScript's Math.random for seed creation in both the create-vault and edit-seed workflows. The shared generator uses crypto.getRandomValues and discards byte values that would bias letter selection. The generator fails when secure randomness is unavailable.

The software changes improve the generation of replacement secrets but do not alter the secret controlling an existing wallet. Keeping an old seed after installing corrected software leaves the existing credential unchanged. A secure replacement identity therefore needs a newly generated secret.

Qubic's RPC endpoint returned epoch 236 and tick 86,154,732 during an October 22 check, beyond the release's starting tick of 86,000,000. Qubic's documentation identifies that endpoint as a source for current tick information.

The portal directs drained QU remaining on Qubic into escrow recovery. The portal assigns funds sent toward MEXC to a separate exchange process, described as slower and dependent on law-enforcement cooperation. The portal assigns vulnerable wallets without stolen funds to release following verification. The reviewed releases, claim rules and tick snapshots contain neither a reconciled total for undrained balances nor an independently verified total for completed repayments. Qubic's design can shield listed balances from a compromised key while making restored access to a secure destination depend on evidence and collective authorization.