Qubic’s recovery rules require ownership checks even for unstolen funds in vulnerable wallets
Qubic's blockchain network updated its recovery rules on October 21, requiring ownership verification even for funds in vulnerable wallets that were never actually stolen.
The blockchain network's October 21 core update introduces stricter recovery protocols that can leave owners of vulnerable wallets needing approval to regain access even when their funds were never stolen. This design extends beyond coins already taken by attackers to include wallets with weakly generated secrets that an attacker could potentially reproduce.
Under these new rules, both the original holder and an attacker could produce valid signatures for the same wallet. To prevent unauthorized access, Qubic's reclaim system requires additional evidence beyond just a signature before approving any claim.
Expanded freeze mechanism
The October 19 v1.308.2 release specifies two distinct escrow operations: moving drained QU from attacker identities and moving QU and assets from vulnerable wallets. It also includes freezing vulnerable identities, canceling their open QX orders, and making tick 85,371,950 empty.
This broader intervention goes beyond tracing coins after theft to securing assets before an attacker has removed them. The system addresses open orders as well as freely available QU balances through an address-based freeze mechanism.
Recovery process requirements
Applicants must provide a listed source identity, a secure new destination, a signed message, and ownership evidence. The portal accepts exchange withdrawal records, funding trails, and signatures from unaffected addresses as valid proof. Core developers review this evidence before the network's computor quorum decides on recovery applications.
The website itself moves no funds.
Didit identity verification remains optional, with the claim window extending through May 1, 2027. Approved addresses and amounts appear for seven days before payout, while unresolved competing claims stay frozen in escrow.
Wallet security improvements
Qubic's v4.26.4 repository release on October 18 addressed how replacement secrets are created by replacing JavaScript's Math.random with crypto.getRandomValues for seed generation. This change improves the process for creating new secure credentials but doesn't fix existing compromised seeds.
As of October 22, Qubic's RPC endpoint reported epoch 236 at tick 86,154,732, beyond the release's 86,000,000 starting point. The recovery process varies depending on fund location, with MEXC-bound funds requiring a separate, slower process involving law enforcement cooperation.
Related
