The Sandbox has released an update on the security incident involving its SAND cross-chain bridge, saying the attacker altered the validation mechanism to forge cross-chain deposit messages and mint unbacked SAND. The company said about 14.7423 million SAND was withdrawn, worth roughly $697,000. It added that some uncollateralized SAND was also traded on the market, bringing the total economic impact to about $1.497 million, while the attacker’s actual profit was around $987,000.
For affected users, The Sandbox said it will compensate wallets holding legitimate bridged SAND on a 1:1 basis with SAND on Ethereum, using a pre-attack on-chain snapshot. The claims process is expected to open within two weeks and remain available for two weeks.
The company also said the incident did not affect the SAND supply on Ethereum or Polygon. Total SAND supply on Ethereum remains unchanged at 3 billion tokens, and no super-admin privileges were compromised. According to the update, the exploit stemmed from a vulnerability created by the combination of a generic call function in the token contract and the bridge permission design. Related addresses have been flagged, and The Sandbox said it is working with exchanges, security firms, and the LayerZero team.
The Sandbox has published an update on the security breach involving its SAND cross-chain bridge, saying the attacker changed the validation mechanism, forged cross-chain deposit messages, and minted unbacked SAND.
According to the update, about 14.7423 million SAND was withdrawn in the incident, worth roughly $697,000. The company said some uncollateralized SAND also generated gains through market trading, bringing the total economic impact to about $1.497 million. Of that amount, the attacker’s actual profit was around $987,000.
Claims process expected within two weeks
The Sandbox said it will compensate wallets holding legitimate bridged SAND with SAND on Ethereum at a 1:1 ratio, based on an on-chain snapshot taken before the attack. The compensation claims process is expected to open within two weeks and will remain open for two weeks.
SAND supply on Ethereum and Polygon unchanged
The company said the attack did not affect the supply of SAND on Ethereum or Polygon. Total SAND supply on Ethereum remains unchanged at 3 billion tokens. It also said no super-admin privileges were stolen in the incident.
Cause of the exploit and ongoing coordination
According to The Sandbox, the breach resulted from a vulnerability created by the interaction between a generic call function in the token contract and the bridge permission design. Relevant addresses have now been flagged, and the company said it has begun coordinating with exchanges, security organizations, and the LayerZero team.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
