Ian

August 22 exploit Post-Mortem is now live. TL;DR: attacker drained 14,742,341.84 SAND (~0.5% of max supply) from the Ethereum vault via a bridge configuration flaw on Base/BSC. Ethereum and Polygon were never affected. We've reported the attacker's wallet to TRM Labs and Chainalysis, engaged directly with exchanges, and are launching a compensation plan for qualified users. Full breakdown, root cause, compensation plan and next steps 👇

Update regarding the recent SAND bridge incident. As shared this past Saturday, the exploit was rapidly contained. Since then, our team has completed the on-chain forensic investigation in collaboration with external security partners. Root cause: on Base and BNB Chain, the SAND token contract also acts as the LayerZero bridge integration. The attacker used a configuration function on that contract to register themselves as the sole verifier of incoming bridge messages, which allowed them to mint unbacked SAND on both networks. The SAND contract was audited by a third party prior to deployment, and we’re investigating why this vulnerability wasn’t identified in the audit. Confirmed Impact: full forensics show the attacker drained 14,742,341.84 SAND from the Ethereum vault backing the bridge, the real economic damage from this incident, representing roughly 0.5% of the fixed 3 billion max supply. Any additional SAND minted on Base or BSC beyond this was never backed by a deposit and cannot be redeemed against the Ethereum vault. Hence we advise against any trading of SAND on Base and BSC until further announcement. This figure is materially higher than our initial estimate on Saturday, which reflected only what was observable during the first hours of containment; we believe it's important to be transparent about that revision as the forensic investigation progresses. Ethereum and Polygon were not affected: no action is required from token holders or liquidity providers on these networks. Since Saturday, we've reported the attacker's wallet to TRM Labs and Chainalysis for stolen-funds tagging, and we've engaged directly with centralized exchanges to have deposits and withdrawals disabled on the affected networks. Bridging to and from Base and BSC remains disabled while we work through remediation. We're finalizing the full incident report and technical post-mortem. We're also evaluating remediation options for qualified users on the impacted networks, and will share further details once the scope has been finalized. We appreciate your patience and continued support. ⚠️ Reminder: our team will NEVER DM you first. Please beware of scam links in the replies.

The Sandbox team has identified and fully contained a recent vulnerability regarding the SAND cross-chain bridge on Base and BNB Smart Chain (BSC). The impact is minimal, representing less than 0.01% of the total SAND token supply. SAND tokens on Ethereum and Polygon are NOT affected. No user wallets were compromised, and no action is required from holders and liquidity pool (LP) providers on those networks. The SAND locked on Ethereum, which backs all bridged SAND, is fully intact. An attacker was able to mint unbacked SAND on Base and BSC. We have disabled bridging to and from both networks, so SAND on Base and BSC is currently isolated and cannot be moved or redeemed. ⚠️ Do not buy, sell, or trade SAND on Base or BSC. Liquidity on those networks is compromised. We are taking a pre-incident snapshot and preparing a compensation plan for the qualified users of the impacted LPs. Affected users can reach out to official support via [email protected]. We continue to monitor the situation and are actively investigating its scope, and we will share a full incident report and detailed technical post-mortem soon. We apologize for the inconvenience this has caused and deeply appreciate the continued patience and support of The Sandbox community. ⚠️ Reminder: Our team will NEVER DM you first. Please beware of scam links in the replies.

Fable 5 dropped. cool, already in the workflow. that's the whole point of bring your own stack 🤝

The Sandbox Studio The AI game engine for the next generation of creators Apply for early access 👇 sandbox.game/en/