A bridge flaw drained about 14.7 million SAND tokens on Aug. 21, worth roughly $700,000. The Sandbox will repay eligible holders on Base and BNB Chain one for one.
The metaverse gaming platform said it will cover the full loss from its own treasury. No new tokens will be minted. Payouts come in Ethereum-based SAND: anyone who held bridged tokens on Base or BNB Smart Chain before the attack receives an equal amount on Ethereum. The drain accounted for about 0.5% of SAND’s 3 billion maximum supply.
The attacker exploited a configuration flaw in the bridge contracts on both networks to become the sole verifier of incoming bridge messages, The Sandbox wrote in a post-mortem published on X on Thursday. From that position, the attacker minted more than 339 trillion unbacked tokens across the two chains.
Those tokens have been isolated. They cannot be bridged or redeemed. SAND on Ethereum and Polygon was not affected.
More than 72% of eligible balances sit on two centralized exchanges, the company said. Those platforms will distribute compensation directly to affected customers. Everyone else uses a claims process The Sandbox expects to open within two weeks and keep open for another two.
The compromised bridge contracts will be permanently retired. Any future bridges to Base or BNB Chain would use newly deployed contracts, the project said.
SAND traded at about $0.04 at the time of publication, down 10.4% over the previous seven days, according to CoinGecko.
