{"id":14798,"date":"2026-10-22T12:19:02","date_gmt":"2026-10-22T12:19:02","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=14798"},"modified":"2026-10-22T12:19:02","modified_gmt":"2026-10-22T12:19:02","slug":"qubic-recovery-requires-ownership-checks-for-vulnerable-wallets","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=14798","title":{"rendered":"Qubic recovery requires ownership checks for vulnerable wallets"},"content":{"rendered":"

<\/p>\n

\n

Qubic\u2019s recovery rules can leave the owner of a vulnerable wallet needing approval to regain access even when its funds were never stolen. The blockchain network\u2019s October 21 core update adds further frozen-address changes to a design that reaches beyond coins already taken by an attacker.<\/p>\n

The incident involved weakly generated wallet secrets that an attacker could reproduce. Both the attacker and the original holder can then produce a valid signature. Qubic\u2019s reclaim rules therefore require evidence beyond that signature before a claim is approved.<\/p>\n

How the freeze changes access<\/h2>\n

The October 19 v1.308.2 release specifies two distinct escrow operations: moving drained QU from attacker identities and moving QU and assets from vulnerable wallets. It also specifies freezing vulnerable identities, canceling their open QX orders and making tick 85,371,950 empty.<\/p>\n

That is a broader intervention than tracing coins after theft. Its stated scope includes securing assets before an attacker has removed them. Canceling an open order also interrupts an existing pending instruction, so the recovery design reaches open orders as well as a freely available QU balance.<\/p>\n

The scope is address based. The release\u2019s frozen-address lookup code loads identities from a list, converts them to public keys and checks whether a public key belongs to that set.<\/p>\n

This distinction separates two questions a holder faces: whether the wallet secret is unsafe and whether the address falls within the recovery mechanism. The published freeze mechanism depends on the address list, while secure replacement credentials require a new seed.<\/p>\n

The October 21 release keeps the address restrictions a current issue. Its notes specify more frozen-address updates and an epoch 236 starting tick of 86,000,000.<\/p>\n

\n

Related Reading<\/span><\/p>\n

Quantum fixes protect Bitcoin, but legit owners risk lockout<\/h3>\n<\/p>\n

<\/span> <\/div>\n

Applicants must provide a listed source identity, a secure new destination, a signed message and ownership evidence. The portal names exchange withdrawal records, earlier funding trails and signatures from unaffected funding addresses as examples. Core developers review that evidence; the network\u2019s computor quorum decides and applies recovery. The website itself moves no funds.<\/p>\n

Didit identity verification is optional. The claim window runs through May 1, 2027. Under the published process, approved addresses and amounts appear for seven days before payout, while unresolved competing claims remain frozen in escrow.<\/p>\n