On the 17th of October, Qubic suffered a major exploit on its protocol. The exploit resulted from the protocol’s lack of randomness while generating seed values in some version of Apple’s products.
As a result, the attacker could drain over 2.9 billion QU tokens worth roughly $1.3 million. A total of 1404 wallets were compromised, and the whole process took less than two hours.
In simple words, the bug could allow an attacker to predict wallet seeds offline, without needing to compromise the Qubic protocol, the network, or individual devices in real time.
However, the bug was limited to wallet creation software and did not affect the overall Qubic protocol.
Recovery of lost funds will depend upon the Computer Quorum decision regarding frozen balances and will require coordination among those who have been impacted by the breach.
Meanwhile, hackers were able to transfer only 12.9% of the stolen QU into their new wallet account. This is because Qubic was able to freeze 87.1% of the stolen QU that hackers transferred into their new wallet account.
Additionally, validators were able to freeze the entire network at block 85,371,949. Thus, virtually all the stolen funds remain frozen. MEXC did eventually freeze the new wallet account containing the remaining 12.9% of stolen QU about an hour after its creation, limiting additional loss.
Qubic has made attempts to minimize the financial impact of the hack by limiting where money can flow from and to within the system. Despite that, ultimately they will need to devise a plan to recover the lost funds.
To prevent similar attacks, Qubic released wallet version 4.26.4. This upgrade would curb the seed-generation weakness, hence securing the platform from future attacks of the same manner.
Looking forward, broader adoption alongside independent testing will determine whether the patch closes the vulnerability.
Regaining user confidence in Qubic will depend upon how quickly and successfully the network returns to normal. However, there is no record of past transactions since all current activity on the network is zero and none of the existing addresses on the blockchain have any activity.
Once transactions resume, a steady increase in transactions and active addresses will prove that users are participating on the network once again. Healthy node participation will ensure that the network continues to operate smoothly and efficiently.
Additionally, exchange support for deposit and withdrawals must also exist before a “technical restart” occurs. If exchange functionality does not include accepting deposits and withdrawing QU, then even though a functional Qubic network exists, there will likely be very little activity.