The Sandbox to Replace Bridged SAND 1:1 Following 14.74M Token Exploit

The Sandbox will reimburse eligible holders of bridged SAND on Base and BNB Chain at a 1:1 ratio with Ethereum-based SAND after an Aug. 22 exploit siphoned 14,742,341.84 SAND from its Ethereum vault, the project said in an Aug. 27 postmortem. The reimbursement applies to legitimately bridged balances captured in a pre-incident snapshot, excluding tokens created via unauthorized minting. The Sandbox said it will cover the replacement tokens from its treasury and will not mint new SAND, keeping the fixed 3 billion maximum supply unchanged. Centralized exchanges hold more than 72% of eligible balances and are expected to credit replacement tokens directly to impacted customers. Other qualifying holders will be able to submit claims through a portal The Sandbox expects to launch within two weeks of the postmortem and keep open for an additional two weeks. Configuration flaw The Sandbox said the SAND token contract on Base and BNB Chain also served as the LayerZero bridge integration. A configuration function allegedly allowed an attacker to register as the sole verifier for incoming bridge messages, enabling fraudulent messages to mint unbacked SAND on both networks. The 14.74 million SAND drained from the Ethereum vault represents about 0.5% of the token's maximum supply. The final loss was materially higher than the project's initial estimate of less than 0.01%, which it said reflected only what was visible during the first hours of containment. The company said SAND on Ethereum and Polygon was not affected. It added that the extra unbacked tokens minted on Base and BNB Chain have been isolated and cannot be bridged to Ethereum or redeemed against the vault. Bridging on the two impacted networks remains disabled. On recovery efforts, The Sandbox said it reported the attacker's wallet to TRM Labs and Chainalysis for stolen-funds tagging and worked with centralized exchanges to disable deposits and withdrawals on the affected networks. The compromised Base and BNB Chain bridge contracts will be permanently retired. Any future bridge to either network would require newly deployed contracts.