Configuration Flaw Let Attacker Become Sole Bridge Verifier

Blockchain gaming platform The Sandbox has pledged to repay eligible SAND holders one-for-one after an August 21 bridge exploit drained about 14.7 million SAND — roughly $700,000 — from an Ethereum vault.

In a post-mortem published Thursday, the company said the attacker exploited a configuration flaw in SAND's Base and BNB Smart Chain contracts that allowed them to become the sole verifier of incoming bridge messages and mint unbacked tokens. The Sandbox confirmed that the drained amount equals about 0.5% of the token's 3 billion maximum supply.

Although more than 339 trillion unbacked SAND was minted on the two affected networks, those tokens have been isolated and cannot be bridged or redeemed. SAND on Ethereum and Polygon was unaffected.

Repayment Terms

Users who legitimately held bridged SAND on Base or BNB Smart Chain before the attack will receive an equal amount of Ethereum-based SAND. Compensation will come from The Sandbox treasury, with no new tokens minted.

The claims process is expected to open within two weeks and remain open for a further two weeks. Two centralized exchanges hold more than 72% of eligible balances and will distribute compensation directly to their affected customers, according to the company.

The compromised bridge contracts will be permanently retired. Any future Base or BNB Chain bridges would use newly deployed contracts, The Sandbox said.

A Rough Week for DeFi Security

The exploit is the second notable DeFi security incident this week. On Thursday, lending protocol Moonwell said it was investigating an issue in its Base lending market after security firms CertiK and PeckShield estimated losses of around $8.7 million from an attack that manipulated the collateral price of the MAMO token.

The two incidents follow a familiar pattern: not novel cryptography failures, but configuration and oracle-level flaws in bridges and lending markets — the same class of vulnerability that has dominated loss reports throughout 2026.

SAND traded at about $0.04 at the time of publication, down 10.4% over the previous seven days, according to CoinGecko.