The Sandbox to Refund Exploited SAND Tokens 1:1 From Treasury

How The Sandbox Plans to Replace Stolen SAND

The Sandbox says it will repay holders of bridged SAND on the Base and BNB Chain networks at a 1-to-1 rate after an Aug. 22 exploit drained about 14.74 million SAND from its Ethereum vault. The project shared the details in an Aug. 27 post-mortem.

The repayment will cover only legitimate bridged balances captured in a pre-incident snapshot, not tokens created through the unauthorized mint. The Sandbox will fund replacements from its own treasury, and no new SAND will be minted as part of the process.

According to the project, this approach leaves the token’s fixed maximum supply of 3 billion SAND unchanged. Two centralized exchanges hold more than 72% of the eligible balances and are expected to distribute replacement tokens directly to affected customers. Other qualifying holders will use a claims portal that The Sandbox expects to open within two weeks of the post-mortem and keep active for an additional two weeks.

Key Numbers From the Exploit

• About 14,742,341.84 SAND were taken from the Ethereum vault.
• That amount represents roughly 0.5% of the total 3 billion maximum supply.
• Two centralized exchanges hold more than 72% of the eligible balances.
• Initial estimates placed the loss at less than 0.01%, based only on early containment data.

What the Post-Mortem Says About the Flaw

The Sandbox explained that on Base and BNB Chain, the SAND token contract also served as the LayerZero bridge integration. A configuration function allowed the attacker to register as the sole verifier of incoming bridge messages, which enabled fraudulent messages to mint unbacked SAND on both networks.

SAND on Ethereum and Polygon was not affected. The additional unbacked tokens minted on Base and BNB Chain were isolated and cannot be bridged to Ethereum or redeemed against the vault. Bridging on the two affected networks remains disabled, and the compromised Base and BNB Chain bridge contracts will be permanently retired. Any future bridge to either network would require newly deployed contracts.

What Is Still Unclear

The project said it had reported the attacker’s wallet to TRM Labs and Chainalysis for stolen-funds tagging and worked with centralized exchanges to disable deposits and withdrawals on the affected networks. It is not yet clear how many external holders qualify beyond the figures disclosed or when the claims portal will be fully operational.

Why This Matters for SAND Holders

The Sandbox’s approach separates legitimate bridged balances from fraudulently minted tokens and commits to funding replacements from treasury rather than creating new supply. For users with bridged SAND on the affected networks, the plan offers a path to recovery while keeping the token’s fixed supply intact.

Sources

• The Defiant