The Sandbox will repay eligible holders of bridged SAND on Base and BNB Chain 1:1 in Ethereum-based SAND after an Aug. 22 exploit drained 14,742,341.84 SAND from its Ethereum vault, the project said in an Aug. 27 post-mortem.
The plan covers legitimately bridged balances recorded in a pre-incident snapshot, rather than tokens created through the unauthorized mint. The Sandbox will fund the replacements from its treasury and said no new SAND will be minted, leaving the token’s fixed 3 billion maximum supply unchanged.
Two centralized exchanges hold more than 72% of eligible balances and are expected to distribute replacement tokens directly to affected customers. Other qualifying holders will use a claims portal that The Sandbox expects to open within two weeks of the post-mortem and keep open for a further two weeks.
Configuration Flaw
On Base and BNB Chain, the SAND token contract also acted as the LayerZero bridge integration, according to The Sandbox. A configuration function allowed the attacker to register as the sole verifier of incoming bridge messages, enabling fraudulent messages to mint unbacked SAND on both networks.
The 14.74 million SAND taken from the Ethereum vault represented about 0.5% of the token’s maximum supply. The final figure was materially higher than The Sandbox’s initial estimate of less than 0.01%, which the project said reflected only what it could observe during the first hours of containment.
The company said SAND on Ethereum and Polygon was unaffected. The additional unbacked tokens minted on Base and BNB Chain were isolated and cannot be bridged to Ethereum or redeemed against the vault, while bridging on the two affected networks remains disabled.
For the attacker’s funds, The Sandbox said it had reported the wallet to TRM Labs and Chainalysis for stolen-funds tagging and worked with centralized exchanges to disable deposits and withdrawals on the affected networks.
The compromised Base and BNB Chain bridge contracts will be permanently retired. Any future bridge to either network would require newly deployed contracts.