Listed vulnerable wallets can require evidence beyond a valid signature before holders regain access, even when an attacker took nothing.
Qubic’s recovery rules can leave the owner of a vulnerable wallet needing approval to regain access even when its funds were never stolen. The blockchain network’s October 21 core update adds further frozen-address changes to a design that reaches beyond coins already taken by an attacker.
The incident involved weakly generated wallet secrets that an attacker could reproduce. Both the attacker and the original holder can then produce a valid signature. Qubic’s reclaim rules therefore require evidence beyond that signature before a claim is approved.
The October 19 v1.308.2 release specifies two distinct escrow operations: moving drained QU from attacker identities and moving QU and assets from vulnerable wallets. It also specifies freezing vulnerable identities, canceling their open QX orders and making tick 85,371,950 empty.
That is a broader intervention than tracing coins after theft. Its stated scope includes securing assets before an attacker has removed them. Canceling an open order also interrupts an existing pending instruction, so the recovery design reaches open orders as well as a freely available QU balance.
The scope is address based. The release’s frozen-address lookup code loads identities from a list, converts them to public keys and checks whether a public key belongs to that set.
This distinction separates two questions a holder faces: whether the wallet secret is unsafe and whether the address falls within the recovery mechanism. The published freeze mechanism depends on the address list, while secure replacement credentials require a new seed.
Source link
