The Sandbox announced it will fully reimburse SAND holders whose tokens were affected by an August 21 bridge exploit on Base and BNB Smart Chain. The attack drained approximately 14.7 million SAND, valued at around $700,000, from an Ethereum vault.
Compensation Plan and Claims Process
According to a post-mortem published on August 27, The Sandbox stated that users who held bridged SAND on Base or BNB Smart Chain before the incident will receive an equivalent amount of SAND on Ethereum. The company clarified that its treasury holds sufficient SAND to cover all affected balances, so there will be no increase in the token’s circulating or maximum supply.
Two major centralized exchanges were identified as holding over 72% of the impacted SAND. These platforms plan to distribute replacement SAND directly to their customers. Meanwhile, other eligible holders will need to use a claims portal once it is launched. The Sandbox has not specified an exact release date for the portal but expects claims to open within two weeks of the post-mortem’s publication and remain open for an additional two weeks.
The Sandbox confirmed that all payments will come from its treasury and that no new SAND tokens will be minted, ensuring the total supply remains unchanged. Claims can be made through exchanges or a forthcoming portal within a limited window.
Vulnerability and Exploit Details
The exploit was traced to a configuration issue in the SAND bridge contracts on Base and BNB Smart Chain, which allowed an attacker to act as the sole verifier for incoming bridge messages. With this authority, the attacker approved fraudulent messages, circumventing standard security checks. This permitted the minting of unbacked SAND on both Base and BNB Smart Chain, even though no tokens were locked on Ethereum as collateral.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLThe attacker ultimately created over 339 trillion unbacked SAND across these networks. The Sandbox reported that these illegitimate tokens have been isolated and cannot be exchanged for real SAND or transferred back to Ethereum.
SAND on Ethereum and Polygon was not impacted. The company said the 14.7 million SAND stolen in the attack represent approximately 0.5% of SAND’s 3 billion token maximum supply.
Mini dictionary: The Sandbox is a blockchain-based virtual world platform where users can create, own, and monetize digital assets and experiences using SAND, its native token.
| Network | SAND Impacted | Status after Attack |
|---|---|---|
| Ethereum | None | Not affected |
| Polygon | None | Not affected |
| Base | Over 339 trillion unbacked minted | Bridge shut down, unbacked SAND isolated |
| BNB Smart Chain | Over 339 trillion unbacked minted | Bridge shut down, unbacked SAND isolated |
Bridge Security Risks Remain
The Sandbox will permanently retire the compromised Base and BNB Smart Chain bridge contracts. Any future bridges to these networks will require completely new contracts.
Bridge-related exploits have continued to be a persistent issue for the crypto industry. In June, Humanity Protocol suffered losses exceeding $36 million after attackers gained access to admin keys on a compromised developer computer. A similar event in July impacted Cardano’s infrastructure via a Wanchain bridge, with BlockSec reporting a loss of about 515 million NIGHT tokens, valued at $9 million at the time.
Also in June, Axelar shut down its bridge to Secret Network after a breach cost $4.7 million, though the main protocol was not affected. In July, AFX lost $24.15 million in USDC through a bridge attack before the funds were converted to nearly 12,468 ETH. The company initiated a recovery plan for affected users soon after.
Cumulatively, cross-chain bridge attacks have resulted in more than $4 billion in losses since 2021. Following the exploit, SAND traded near $0.04, reflecting a 10.4% decline over the previous week.
