The Sandbox indicates that eligible SAND holders affected by the cross-chain bridge attack on August 21 will be compensated at a ratio of 1:1. The compensation will be made using existing tokens from the project's treasury, and no new SAND will be issued. The project expects to open the application window within two weeks, which will last for two weeks as well.
The scope of compensation has been clarified.
According to the post-event analysis released on August 27th, the compensation is intended for users who legally held the bridged version of SAND on Base or BNB Smart Chain before the attack occurred. Eligible holders will receive an equivalent amount of SAND on the Ethereum blockchain.
According to The Sandbox, over 72% of the qualified balances are concentrated on two centralized exchanges. These users do not need to submit applications separately; the relevant exchanges will directly distribute alternative tokens to the affected customers. The remaining holders will need to submit applications through the application portal that will be launched later.
- The scale of the damage is approximately 14.7 million SAND.
- Calculated based on the price at the time of post-event analysis, it is approximately worth $700,000.
- Approximately 0.5% of the maximum supply of SAND which is 3 billion coins.
The vulnerability lies in the verification configuration.
The project party attributed this incident to a configuration issue with the SAND contract on Base and BNB Smart Chain. This flaw allowed attackers to gain cross-chain message verification rights, making them the sole verifiers, thereby enabling them to approve forged messages without proper authorization.
Under these conditions, attackers were able to mint SAND on the target chain without the support of any Ethereum locked-up assets. Post-event analysis revealed that the total amount of unsecured SAND minted on Base and BNB Smart Chain exceeded 339 trillion coins.
The Sandbox indicates that these abnormal tokens have been isolated and cannot be bridged back to Ethereum, nor can they be exchanged for legal reserves. SAND deployed on Ethereum and Polygon has not been affected by this configuration defect.
Affected bridging contracts will be disabled.
After the attack, The Sandbox decided not to restore the affected bridging contract between Base and BNB Smart Chain, but to permanently deactivate it instead. If there is a need to re-establish the bridging function with these two chains in the future, new contracts will need to be deployed, but the project team has not yet provided a timeline for this.
Cross-chain bridges have always been a high-risk area for security incidents in the cryptocurrency industry. The core of this compensation plan is to distinguish between the actual bridge balances that existed before the attack and the unsecured tokens generated after the attack, and then use SAND on the Ethereum blockchain to complete the replacement.
Additional information:SAND had a trading price of approximately $0.04 at the time of the post-event analysis release, and it has declined by about 10.4% over the past 7 days.
