Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
SAND The Sandbox's official post-mortem analysis: Bridging vulnerabilities and fake token minting
The Sandbox released an official post-mortem analysis of the bridging vulnerability incident that occurred last week, which finally determined the number of unsecured SAND tokens minted by the attacker: a total of more than 339 trillion on the Base and BNB smart chains.
This number ends five days of confusing reports. According to blockchain security company PeckShield, early estimates ranged from 500 million to 14.9 billion, while other reports put the nominal value close to $49 billion. At the time, it was reported that the true scale had not yet been checked against the contract's own forging log. But all of these numbers, including the results after verification, have never corresponded to real funds.
Fake minting tokens that cannot be circulated
You can understand why by checking the Base liquidity pool that attackers use to cash out. As of this week, the contract still holds approximately 26.3 trillion unsecured SAND, worth approximately US$1.046 trillion at current SAND prices. These tokens cannot be traded, bridged, or redeemed. Sandbox disabled the bridging function at the contract level within hours of the vulnerability, and no withdrawals have been successful since August 22.
The actual stolen funds
The actual losses are much smaller. The attacker extracted 14,742,341.84 SAND (approximately US$697,000) from the treasury contracts supporting SAND on Ethereum. The vulnerability stems from a convenience feature in token contracts that allows an attacker to register himself as a bridge administrator and then set himself up as the sole verifier of incoming bridge messages.
Some unsecured SAND were sold directly on Base, and the attacker extracted assets from a single trading pool that exceeded 20 times its available liquidity through duplicate transactions. The rest is used to redeem the real SAND through a bridged reverse path, but an unrelated robot took the lead and bought the unsecured SAND on the open market, partially intercepting the redemption opportunity.
Sandbox estimates that combining the loss of treasury and the theft of Ethereum on Base, the total economic impact is approximately US$1.5 million. Among them, the attackers themselves made approximately US$987,000.
1:1 Full Repayment
Sandbox stated that all wallets that held SAND on the Base or BNB smart chain through legal bridges before the vulnerability occurred will receive a 1:1 full repayment of SAND on Ethereum, with funds coming from their treasury rather than new token issuance. The qualification period is fixed to the on-chain balance recorded in Base Block 50,283,176 and BSC Block 117,321,965 (i.e. the moment before the first unauthorized casting occurred).
Sandbox said that the two exchanges hold more than 72% of the affected balances and will be repaid directly. Other users are required to submit applications after the process starts. It is expected to open within two weeks after the announcement is released on August 27, and the application window lasts for two weeks.
Matters to Note for Holders
Sandbox said that holders who miss the Ethereum application window will not lose their rights. Once the new alternative bridging contract is deployed on the Base and BNB smart chains (this time the tokens and bridging functions have been built separately), the same number of tokens will be available again at the new address. Retired contracts will not be reactivated. Sandbox pointed out that the vulnerability that allowed an attacker to reassign bridge management rights has been fixed in the contract bytecode and cannot be resolved through patches.
