Cryptopolitan and Cointelegraph agree on how The Sandbox's bridge was exploited and on its 1:1 compensation plan, but give different dollar values for the same ~14.74 million SAND withdrawn from the Ethereum vault.
Cryptopolitan and Cointelegraph agree on how The Sandbox's bridge was exploited and on its 1:1 compensation plan, but give different dollar values for the same ~14.74 million SAND withdrawn from the Ethereum vault.
What all sources agree on
- The Sandbox will compensate holders who legitimately held bridged SAND on Base or BNB Smart Chain 1:1 with Ethereum-based SAND.
- The claims process is expected to open within two weeks of the August 27 disclosure and remain open for another two weeks.
- The exploit involved a configuration flaw in SAND's Base and BNB Chain token contracts that let the attacker register as verifier/administrator and mint unbacked tokens.
- The attacker withdrew roughly 14.74 million SAND from the Ethereum vault.
- SAND on Ethereum and Polygon was unaffected.
- The compromised bridge contracts will not be reopened / will be permanently retired.
Where the reports disagree
1USD value of the ~14.74 million SAND withdrawn from the Ethereum vault
Forensics put the direct vault withdrawal at 14,742,341.84 SAND. The attacker walked away with roughly $987,000.
an Aug. 21 bridge exploit drained 14.744 SAND, worth about $700,000, from an Ethereum vault.
What would settle it: The Sandbox's on-chain post-mortem transaction data / the Ethereum vault withdrawal transaction itself.
What to make of it
Treat the 1:1 compensation commitment, the two-week claim window, and the ~14.74 million SAND withdrawal amount as established; the dollar value of that withdrawal ($987,000 vs $700,000) is unresolved and shouldn't be relied on until The Sandbox's own transaction data or filing clarifies it.
Treat the 1:1 compensation commitment, the two-week claim window, and the ~14.74 million SAND withdrawal amount as established; the dollar value of that withdrawal ($987,000 vs $700,000) is unresolved and shouldn't be relied on until The Sandbox's own transaction data or filing clarifies it.
