The Sandbox will repay eligible SAND holders 1:1 after an Aug. 21 bridge exploit drained about 14.7 million tokens worth roughly $700,000. The Sandbox says its treasury already holds the funds needed, so no new SAND will be minted, and it plans to retire the compromised bridges permanently.
The Sandbox has pledged to reimburse eligible SAND holders 1:1 after an Aug. 21 bridge exploit drained about 14.7 million tokens worth roughly $700,000 from an Ethereum vault. According to the project's Aug. 27 post-mortem, users who legitimately held bridged SAND on Base or BNB Smart Chain before the attack will receive an equivalent amount of Ethereum-based SAND.
The Sandbox will repay SAND holders from its treasury
The Sandbox said its treasury already holds the tokens required for the process, so the compensation will not increase SAND's circulating or maximum supply. Two centralized exchanges account for more than 72% of the eligible SAND balances, and those exchanges will distribute replacement tokens directly to their customers without individual claims.
For other holders, the project plans to launch a claims portal expected to open within two weeks of the post-mortem, remaining available for another two weeks after that. The stolen amount represented roughly 0.5% of SAND's maximum supply of 3 billion tokens.
Configuration flaw gave the attacker control of bridge verification
The Sandbox traced the incident to a configuration problem in the SAND smart contract deployments on Base and BNB Smart Chain. The flaw let the attacker become the sole verifier for incoming bridge messages, allowing fraudulent messages to pass without the authorization the cross-chain bridge normally requires.
With that control, the attacker was able to mint SAND on the destination chains even though no corresponding tokens had been locked on Ethereum. More than 339 trillion unbacked SAND tokens were eventually minted across Base and BNB Smart Chain, and the project said that fraudulent supply has since been isolated and cannot be redeemed against legitimate reserves. SAND deployed directly on Ethereum and Polygon was not affected.
Compromised bridges will be permanently retired
The Sandbox decided not to restore the affected Base and BNB Smart Chain bridge contracts; both will be permanently retired. Any future bridge connecting SAND to either network would require newly deployed contracts, though the project gave no timetable for that.
The decision follows a pattern this year. Humanity Protocol lost more than $36 million to a bridge compromise in June. Wanchain's bridge connecting Cardano and BNB Chain lost roughly $9 million in July. SAND was trading near $0.04 at the time of the post-mortem, down about 10.4% over the previous seven days.
Source: crypto.news
Trading involves risk.
Risk Disclaimer
