Blockchain gaming platform The Sandbox has pledged to repay eligible SAND holders 1:1 after an Aug. 21 bridge exploit drained 14.744 SAND, worth about $700,000, from an Ethereum vault.
On Thursday, the company published a post-mortem, saying users who legitimately held bridged SAND on Base or BNB Smart Chain before the attack will receive an equal amount of Ethereum-based SAND. Compensation will come from The Sandbox treasury, with no new tokens minted.
The claims process is expected to open within two weeks and remain open for another two weeks. Two centralized exchanges hold more than 72% of eligible balances and will distribute compensation directly to their affected customers, according to The Sandbox.
The project said the attacker exploited a configuration flaw in SAND’s Base and BNB Chain contracts, allowing them to become the sole verifier of incoming bridge messages and mint unbacked tokens. The Sandbox confirmed that about 14.7 million SAND tokens were drained, equivalent to about 0.5% of the token’s 3 billion maximum supply.
Although more than 339 trillion unbacked SAND was minted on the two networks, those tokens have been isolated and cannot be bridged or redeemed. SAND on Ethereum and Polygon was unaffected.
The compromised bridge contracts will be permanently retired. The Sandbox said any future Base or BNB Chain bridges would use newly deployed contracts.
SAND traded at about $0.04 at the time of publication, down 10.4% over the previous seven days, according to CoinGecko.
Related: Hugging Face hack exposes the open-weight AI cybersecurity paradox