{"investigation":{"slug":"the-sandbox-sand-oft-exploit","entity_name":"The Sandbox (SAND OFT Exploit)","trust_score":42,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"On August 21-22, 2026, an attacker exploited a configuration flaw in The Sandbox's SAND omnichain fungible token (OFT) contract on Base, hijacking LayerZero delegate permissions via the approveAndCall function to mint 329.24 trillion unbacked SAND tokens across 703 events over approximately five hours. Despite a nominal face-value figure of roughly $49 billion, actual liquid losses were contained to approximately 14.75 million SAND (~$675,000) and 79.74 ETH drained from the Ethereum OFT Adapter. The Sandbox halted Base and BNB Smart Chain bridges, removed LayerZero peer settings via multisig, and subsequently announced a 1:1 treasury-funded compensation plan for affected liquidity providers using a pre-exploit snapshot.","sections":[{"content":"At approximately 23:42:05 UTC on August 21, 2026, an attacker began exploiting The Sandbox's SAND omnichain fungible token (OFT) contract deployed on the Base network. The attack ran for approximately five hours, concluding at around 04:45:21 UTC on August 22. Security firm Blockaid detected the exploit while it was ongoing and issued a public alert stating that attackers had hijacked LayerZero delegate permissions via the approveAndCall function and were minting unbacked SAND at scale. By the time minting activity stopped, 329.24 trillion unbacked SAND tokens had been created across 703 events. Blockaid reported the face-value figure at approximately $49 billion based on prevailing market prices; PeckShield separately counted approximately 14.9 billion SAND directed to two attacker-controlled addresses (0xAbE0...4D22 and 0x638C...F296). The discrepancy between figures reflects differences in methodology — the much larger Blockaid total includes all minting events, many of which involved tokens that could not be liquidated.","heading":"Incident Overview","sources":[{"url":"https://x.com/blockaid_/status/2091016046555582891","name":"Blockaid on X: real-time exploit detection alert","type":"social_media","credibility":2},{"url":"https://crypto.news/sandbox-bridge-exploit-49-billion-phantom-sand-mint/","name":"Crypto.news: The Sandbox's $49 billion phantom mint","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/","name":"CryptoTimes: Sandbox SAND Hacked — Attackers Mint 329 Trillion Tokens on Base in 5-Hour Rampage","type":"news_article","credibility":2},{"url":"https://coinpaprika.com/news/sandbox-halts-base-bnb-bridges-exploit-49b/","name":"CoinPaprika: The Sandbox Halts Base and BNB Bridges After Exploit Mints $49B in Phantom SAND","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The root cause of the exploit was a configuration flaw in The Sandbox's OFT bridge contracts deployed on Base and BNB Smart Chain, not a vulnerability in the LayerZero protocol itself. Blockaid described the issue as an application-level configuration problem. The attacker weaponized SAND's approveAndCall function — an ERC-20 extension originally designed as a user-experience shortcut allowing a token approval and a follow-on contract call to be bundled into a single transaction. By crafting a malicious payload routed through this function into the LayerZero endpoint, the attacker was able to grant an attacker-controlled helper contract the effective standing of a LayerZero delegate. Once that delegation was established, the attacker had authority to instruct the OFT contract on Base to mint SAND without a corresponding burn or lock of SAND on Ethereum. The Ethereum OFT Adapter — the contract holding real SAND backing the bridged supply — was separately targeted: approximately 14,769,723 SAND was drained from it in under 60 seconds through what appeared to be automated withdrawal scripts executing six transactions across 24 seconds. The compromised bridge contracts on both Base and BNB Smart Chain have since been permanently retired. The configuration flaw, as later described in The Sandbox's post-mortem, allowed the attacker to become the sole verifier for bridge messages on those deployments.","heading":"Technical Vulnerability: approveAndCall and LayerZero Delegate Hijacking","sources":[{"url":"https://crypto.news/sandbox-bridge-exploit-49-billion-phantom-sand-mint/","name":"Crypto.news: The Sandbox's $49 billion phantom mint — technical breakdown","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/","name":"CryptoTimes: Sandbox SAND Hacked — technical details","type":"news_article","credibility":2},{"url":"https://cryptorank.io/news/feed/49fcb-the-sandbox-sand-exploit-49b-in-new-tokens-flood-base","name":"CryptoRank: The Sandbox SAND Exploit — $49B in New Tokens Flood Base","type":"news_article","credibility":2},{"url":"https://www.brinztech.com/breach-alerts/brinztech-incident-report-cross-chain-bridge-configuration-flaw-leads-to-unbacked-token-minting-on-base-and-bnb-smart-chain-the-sandbox-sand-incident","name":"Brinztech Incident Report: Cross-Chain Bridge Configuration Flaw","type":"research","credibility":2},{"url":"https://crypto.news/sand-bridge-exploit-contained-unbacked-token-mint/","name":"Crypto.news: SAND bridge exploit contained after unbacked token mint","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The $49 billion face-value figure reported by Blockaid and widely circulated in press coverage represents the market price of 329.24 trillion SAND tokens at the time of minting — not money the attacker actually extracted. Because the minted supply exceeded the legitimate 3 billion SAND supply by a factor of approximately 110,000, no market could have absorbed even a small fraction at the quoted price; an attempt to sell would have collapsed the price to near zero. The actual financial extraction was considerably smaller. On-chain forensics showed the attacker drained approximately 14.75 million SAND from the Ethereum OFT Adapter within under 60 seconds; this SAND was sold for approximately 79.74 ETH, valued at roughly $675,000 at transaction time. The Sandbox stated that actual impact represented less than 0.01% of the total 3 billion SAND supply. PeckShield noted 14.9 billion SAND reached two attacker-controlled addresses, but only the Ethereum-backed portion (~14.75 million SAND) could be converted to other assets through the official bridge; the rest of the minted tokens had no backing and could not be redeemed. The pre-exploit attacker address had been dormant for 313 days, suggesting deliberate pre-positioning.","heading":"Actual Financial Losses vs. Headline Figures","sources":[{"url":"https://crypto.news/sandbox-bridge-exploit-49-billion-phantom-sand-mint/","name":"Crypto.news: The Sandbox's $49 billion phantom mint","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/","name":"CryptoTimes: Sandbox SAND Hacked","type":"news_article","credibility":2},{"url":"https://pro.edgex.exchange/en-US/news/article/sandbox-bridge-exploit-49b-vs-675k-drain","name":"EdgeX: Sandbox Exploit Created $49B in Unbacked SAND Nobody Could Cash Out","type":"news_article","credibility":2},{"url":"https://coinspectator.com/cryptonews/2026/08/30/the-sandbox-minted-329-trillion-unbacked-sand-tokens-in-5-hours-and-only-675k-was-stolen/","name":"CoinSpectator: The Sandbox minted 329 trillion unbacked SAND tokens in 5 hours and only $675K was stolen","type":"news_article","credibility":2}],"severity":"high"},{"content":"The Sandbox responded by disabling bridging on both the Base and BNB Smart Chain networks. The team removed LayerZero peer settings from the affected OFT contracts via multisig at approximately 05:09:19 UTC on August 22, 2026 — roughly five hours after the exploit began. SAND on Ethereum and Polygon was confirmed unaffected throughout. The Sandbox stated publicly: 'All bridged SAND funds are backed by SAND locked on Ethereum, which remains entirely secure.' The compromised bridge contracts on Base and BNB Smart Chain were permanently retired and will not be restored; replacement contracts are expected to deploy once security review is complete. No user wallets were directly compromised in the exploit. Blockaid classified the root cause as an application-level configuration issue rather than a fault in the LayerZero protocol.","heading":"Containment and Immediate Response","sources":[{"url":"https://www.coindesk.com/web3/2026/08/22/web3-gaming-network-sandbox-stops-base-and-bnb-chain-bridging-after-exploit","name":"CoinDesk: Web3 gaming network Sandbox stops Base and BNB chain bridging after exploit","type":"news_article","credibility":1},{"url":"https://crypto.news/sand-bridge-exploit-contained-unbacked-token-mint/","name":"Crypto.news: SAND bridge exploit contained after unbacked token mint","type":"news_article","credibility":2},{"url":"https://coinpaprika.com/news/sandbox-halts-base-bnb-bridges-exploit-49b/","name":"CoinPaprika: The Sandbox Halts Base and BNB Bridges After Exploit Mints $49B in Phantom SAND","type":"news_article","credibility":2},{"url":"https://castlecrypto.gg/news/the-sandbox-isolates-cross-chain-bridge-vulnerability-on-base-and-bsc/","name":"Castle Crypto: The Sandbox Isolates Cross Chain Bridge Vulnerability on Base and BSC","type":"news_article","credibility":2}],"severity":"medium"},{"content":"On August 27, 2026, The Sandbox announced a 1:1 compensation plan for wallets that legitimately held bridged SAND on Base or BNB Smart Chain at the time of the exploit. Eligibility was determined using on-chain snapshots taken immediately before the unauthorized minting began: Base block 50,283,176 and BSC block 117,321,965. Every eligible wallet will receive an equivalent amount of Ethereum-based SAND in replacement. The compensation is funded entirely from The Sandbox treasury; no new SAND tokens will be minted, preserving the existing 3 billion fixed supply. A claims portal was expected to open within two weeks of the announcement, with a two-week submission window thereafter. The Sandbox noted that wallets holding balances through two major centralized exchanges — representing over 72% of affected SAND — would receive compensation directly from those exchanges without needing to file individual claims. For wallets missing the initial claim window, unclaimed compensation was stated to become available on Base and BNB Smart Chain once replacement bridge contracts deploy. The total compensation liability is consistent with the approximately 14.75 million SAND in legitimate bridged balances drained, valued at roughly $675,000–$700,000.","heading":"Compensation Plan","sources":[{"url":"https://crypto.news/the-sandbox-to-reimburse-sand-holders-after-14-7m-token-bridge-exploit/","name":"Crypto.news: The Sandbox to reimburse SAND holders after 14.7M token bridge exploit","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/27/the-sandbox-sets-11-compensation-plan-for-base-and-bnb-chain-sand-holders/","name":"CryptoTimes: The Sandbox Sets 1:1 Compensation Plan for Base and BNB Chain SAND Holders","type":"news_article","credibility":2},{"url":"https://crypto-economy.com/the-sandbox-to-fully-refund-bridge-exploit-victims-after-697k-sand-theft/","name":"Crypto Economy: The Sandbox to Fully Refund Bridge Exploit Victims After $697K SAND Theft","type":"news_article","credibility":2},{"url":"https://www.cryptobreaking.com/the-sandbox-commits-to-11/","name":"CryptoBreaking: The Sandbox Commits to 1:1 Refund After $700K Bridge Exploit","type":"news_article","credibility":2}],"severity":"low"},{"content":"South Korean exchanges Upbit and Bithumb halted SAND deposits and withdrawals on August 22, 2026, citing the Virtual Asset User Protection Act. On August 24, Upbit formally designated SAND as an investment warning asset effective 15:00 KST, affecting SAND/KRW and SAND/BTC trading pairs; under this framework, deposits cannot be processed for the duration of the designation and any attempted deposits are returned. Upbit's review window extends through early October 2026, after which the exchange will determine whether to lift, extend, or terminate the caution designation. Bithumb conducted its own review between September 28 and October 2, 2026. Both exchanges continued spot trading with price volatility warnings. Coinbase delisted SAND futures following the incident. The SAND token price declined approximately 5.5–10% intraday, with CoinGecko marking SAND at $0.03879 and market capitalization falling to approximately $113.7–$115 million. Spot volume spiked to approximately 24 times baseline and futures open interest rose 16%, with funding rates turning sharply negative. Korean won trading pairs represent a disproportionate share of global SAND volume, making the Korean exchange reviews consequential for the token's continued market presence.","heading":"Exchange and Market Impact","sources":[{"url":"https://www.cryptotimes.io/2026/08/24/sand-faces-upbit-bithumb-delisting-risk-after-49b-mint-attack/","name":"CryptoTimes: SAND Faces Upbit, Bithumb Delisting Risk After $49B Mint Attack","type":"news_article","credibility":2},{"url":"https://crypto.news/sand-bridge-exploit-contained-unbacked-token-mint/","name":"Crypto.news: SAND bridge exploit contained after unbacked token mint","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/","name":"CryptoTimes: Sandbox SAND Hacked — market data","type":"news_article","credibility":2}],"severity":"high"},{"content":"The SAND incident is the third notable LayerZero OFT peer or delegate abuse reported in 2026. In April 2026, an attacker who had previously compromised a LayerZero Labs developer through social engineering forged cross-chain messages through a single compromised Decentralized Verifier Network (DVN) and drained approximately 116,500 rsETH (worth approximately $292 million) from KelpDAO's Ethereum OFT Adapter. In May 2026, a compromised deployer key was used to reset the trusted peer on StakeDAO's vsdCRV OFT in a separate incident. The SAND exploit differs in mechanism — it relied on an application-level approveAndCall configuration flaw rather than a compromised DVN or deployer key — but the pattern of attackers targeting OFT bridge authority has emerged as a recurring theme across the LayerZero ecosystem in 2026. Blockaid explicitly described the SAND exploit as an application-level issue, not a fault in the LayerZero protocol itself, a characterization consistent with how LayerZero Labs characterized the KelpDAO incident (the KelpDAO incident report was published by LayerZero on May 18, 2026). The broader pattern has reportedly spurred migration discussions from LayerZero to alternative bridge infrastructure.","heading":"Broader Context: Recurring LayerZero OFT Exploits in 2026","sources":[{"url":"https://blockaid.io/blog/how-a-single-layerzero-dvn-compromise-drained-292m-from-kelpdao","name":"Blockaid Blog: How a Single LayerZero DVN Compromise Drained $292M from KelpDAO","type":"research","credibility":2},{"url":"https://layerzero.network/publications/kelpdao-incident-report.pdf","name":"LayerZero: LayerZero Labs KelpDAO Incident Report (PDF)","type":"official","credibility":1},{"url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","name":"CoinDesk: Kelp claims LayerZero approved setup blamed for $292 million bridge hack","type":"news_article","credibility":1},{"url":"https://www.cryptotimes.io/2026/08/24/sand-faces-upbit-bithumb-delisting-risk-after-49b-mint-attack/","name":"CryptoTimes: SAND Faces Upbit, Bithumb Delisting Risk — broader LayerZero context","type":"news_article","credibility":2}],"severity":"high"},{"content":"As of August 30, 2026, The Sandbox had not published an exact timeline for reopening Base or BNB Smart Chain bridges. Replacement bridge contracts had not yet been deployed. The claims portal for compensation had not yet opened. The Sandbox had not officially confirmed Blockaid's attribution of the exploit mechanism (approveAndCall as the delegate hijack vector) in its own post-mortem language, though the technical assessment was consistent with the official characterization of a configuration flaw. Animoca Brands, The Sandbox's parent company, had not issued a public statement as of the time of primary reporting. No arrest or attribution of the attacker was publicly reported. The Upbit and Bithumb delisting review processes were ongoing, with outcomes expected in late September to early October 2026. The ultimate fate of the 329.24 trillion phantom-minted tokens — which cannot be bridged or redeemed — was not formally addressed in public communications.","heading":"Open Items and Unresolved Questions","sources":[{"url":"https://crypto.news/sand-bridge-exploit-contained-unbacked-token-mint/","name":"Crypto.news: SAND bridge exploit contained after unbacked token mint","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/27/the-sandbox-sets-11-compensation-plan-for-base-and-bnb-chain-sand-holders/","name":"CryptoTimes: The Sandbox Sets 1:1 Compensation Plan","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2026-08-21","event":"Attack begins at approximately 23:42:05 UTC. Attacker exploits approveAndCall on SAND's OFT contract on Base, hijacking LayerZero delegate permissions and beginning unbacked SAND minting.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/"},{"date":"2026-08-22","event":"At approximately 01:22:11 UTC, the Ethereum OFT Adapter is drained to near-zero; approximately 14,769,723 SAND is withdrawn and converted to roughly 79.74 ETH (~$675,000).","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/"},{"date":"2026-08-22","event":"Blockaid issues a real-time public alert on X reporting an ongoing exploit on The Sandbox's SAND OFT on Base, citing $49 billion face-value minted across 400+ transactions.","source":"Blockaid on X","source_url":"https://x.com/blockaid_/status/2091016046555582891"},{"date":"2026-08-22","event":"Minting activity stops at approximately 04:45:21 UTC after approximately five hours. Total minted: 329.24 trillion unbacked SAND across 703 events.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/"},{"date":"2026-08-22","event":"The Sandbox multisig removes LayerZero peer settings at approximately 05:09:19 UTC. Base and BNB Smart Chain bridges disabled. Ethereum and Polygon SAND confirmed unaffected.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/"},{"date":"2026-08-22","event":"Upbit and Bithumb halt SAND deposits and withdrawals at 11:11 KST. Coinbase delists SAND futures. SAND price declines 5.5–10% intraday.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/24/sand-faces-upbit-bithumb-delisting-risk-after-49b-mint-attack/"},{"date":"2026-08-24","event":"Upbit designates SAND as an investment warning asset effective 15:00 KST under Article 17 of the Virtual Asset User Protection Act, affecting SAND/KRW and SAND/BTC pairs. Review window extends through early October 2026.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/24/sand-faces-upbit-bithumb-delisting-risk-after-49b-mint-attack/"},{"date":"2026-08-27","event":"The Sandbox announces 1:1 treasury-funded compensation plan for affected SAND holders on Base and BNB Smart Chain, using pre-exploit snapshots (Base block 50,283,176; BSC block 117,321,965). Claims portal expected within two weeks.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/27/the-sandbox-sets-11-compensation-plan-for-base-and-bnb-chain-sand-holders/"},{"date":"2026-08-28","event":"Brinztech publishes an incident report classifying the event as a critical configuration and permission flaw in the SAND OFT bridge infrastructure.","source":"Brinztech Breach Alerts","source_url":"https://www.brinztech.com/breach-alerts/brinztech-incident-report-cross-chain-bridge-configuration-flaw-leads-to-unbacked-token-minting-on-base-and-bnb-smart-chain-the-sandbox-sand-incident"}],"sources_used":[{"url":"https://crypto.news/sandbox-bridge-exploit-49-billion-phantom-sand-mint/","name":"Crypto.news: The Sandbox's $49 billion phantom mint","type":"news_article","archive_url":"http://web.archive.org/web/20260824222855/https://crypto.news/sandbox-bridge-exploit-49-billion-phantom-sand-mint/","credibility":2,"archive_timestamp":"2026-08-24T22:28:55+00:00"},{"url":"https://coinpaprika.com/news/sandbox-halts-base-bnb-bridges-exploit-49b/","name":"CoinPaprika: The Sandbox Halts Base and BNB Bridges After Exploit Mints $49B in Phantom SAND","type":"news_article","archive_url":"http://web.archive.org/web/20260826193741/https://coinpaprika.com/news/sandbox-halts-base-bnb-bridges-exploit-49b/","credibility":2,"archive_timestamp":"2026-08-26T19:37:41+00:00"},{"url":"https://cryptorank.io/news/feed/49fcb-the-sandbox-sand-exploit-49b-in-new-tokens-flood-base","name":"CryptoRank: The Sandbox SAND Exploit — $49B in New Tokens Flood Base","type":"news_article","archive_url":"http://web.archive.org/web/20260825004515/https://cryptorank.io/news/feed/49fcb-the-sandbox-sand-exploit-49b-in-new-tokens-flood-base","credibility":2,"archive_timestamp":"2026-08-25T00:45:15+00:00"},{"url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/","name":"CryptoTimes: Sandbox SAND Hacked — Attackers Mint 329 Trillion Tokens on Base in 5-Hour Rampage","type":"news_article","archive_url":"http://web.archive.org/web/20260824181711/https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/","credibility":2,"archive_timestamp":"2026-08-24T18:17:11+00:00"},{"url":"https://www.coindesk.com/web3/2026/08/22/web3-gaming-network-sandbox-stops-base-and-bnb-chain-bridging-after-exploit","name":"CoinDesk: Web3 gaming network Sandbox stops Base and BNB chain bridging after exploit","type":"news_article","archive_url":null,"credibility":1,"archive_timestamp":null},{"url":"https://thedefiant.io/news/hacks/the-sandbox-says-it-contained-bridge-exploit-that-minted-unbacked-sand-on-base-and-bsc","name":"The Defiant: The Sandbox Says It Contained Bridge Exploit That Minted Unbacked SAND on Base and BSC","type":"news_article","archive_url":"http://web.archive.org/web/20260822173735/https://thedefiant.io/news/hacks/the-sandbox-says-it-contained-bridge-exploit-that-minted-unbacked-sand-on-base-and-bsc","credibility":2,"archive_timestamp":"2026-08-22T17:37:35+00:00"},{"url":"https://x.com/blockaid_/status/2091016046555582891","name":"Blockaid on X: real-time exploit detection alert","type":"social_media","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://crypto.news/sand-bridge-exploit-contained-unbacked-token-mint/","name":"Crypto.news: SAND bridge exploit contained after unbacked token mint","type":"news_article","archive_url":"http://web.archive.org/web/20260824135319/https://crypto.news/sand-bridge-exploit-contained-unbacked-token-mint/","credibility":2,"archive_timestamp":"2026-08-24T13:53:19+00:00"},{"url":"https://www.cryptotimes.io/2026/08/24/sand-faces-upbit-bithumb-delisting-risk-after-49b-mint-attack/","name":"CryptoTimes: SAND Faces Upbit, Bithumb Delisting Risk After $49B Mint Attack","type":"news_article","archive_url":"http://web.archive.org/web/20260825030032/https://www.cryptotimes.io/2026/08/24/sand-faces-upbit-bithumb-delisting-risk-after-49b-mint-attack/","credibility":2,"archive_timestamp":"2026-08-25T03:00:32+00:00"},{"url":"https://crypto.news/the-sandbox-to-reimburse-sand-holders-after-14-7m-token-bridge-exploit/","name":"Crypto.news: The Sandbox to reimburse SAND holders after 14.7M token bridge exploit","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://www.cryptotimes.io/2026/08/27/the-sandbox-sets-11-compensation-plan-for-base-and-bnb-chain-sand-holders/","name":"CryptoTimes: The Sandbox Sets 1:1 Compensation Plan for Base and BNB Chain SAND Holders","type":"news_article","archive_url":"https://web.archive.org/web/20260901124831/https://www.cryptotimes.io/2026/08/27/the-sandbox-sets-11-compensation-plan-for-base-and-bnb-chain-sand-holders/","credibility":2,"archive_timestamp":"2026-09-01T12:48:31+00:00"},{"url":"https://crypto-economy.com/the-sandbox-to-fully-refund-bridge-exploit-victims-after-697k-sand-theft/","name":"Crypto Economy: The Sandbox to Fully Refund Bridge Exploit Victims After $697K SAND Theft","type":"news_article","archive_url":"https://web.archive.org/web/20260901073712/https://crypto-economy.com/the-sandbox-to-fully-refund-bridge-exploit-victims-after-697k-sand-theft/","credibility":2,"archive_timestamp":"2026-09-01T07:37:12+00:00"},{"url":"https://www.cryptobreaking.com/the-sandbox-commits-to-11/","name":"CryptoBreaking: The Sandbox Commits to 1:1 Refund After $700K Bridge Exploit","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://pro.edgex.exchange/en-US/news/article/sandbox-bridge-exploit-49b-vs-675k-drain","name":"EdgeX: Sandbox Exploit Created $49B in Unbacked SAND Nobody Could Cash Out","type":"news_article","archive_url":"http://web.archive.org/web/20260824160242/https://pro.edgex.exchange/en-US/news/article/sandbox-bridge-exploit-49b-vs-675k-drain","credibility":2,"archive_timestamp":"2026-08-24T16:02:42+00:00"},{"url":"https://blockaid.io/blog/how-a-single-layerzero-dvn-compromise-drained-292m-from-kelpdao","name":"Blockaid Blog: How a Single LayerZero DVN Compromise Drained $292M from KelpDAO","type":"research","archive_url":"http://web.archive.org/web/20260515225319/https://blockaid.io/blog/how-a-single-layerzero-dvn-compromise-drained-292m-from-kelpdao","credibility":2,"archive_timestamp":"2026-05-15T22:53:19+00:00"},{"url":"https://layerzero.network/publications/kelpdao-incident-report.pdf","name":"LayerZero: LayerZero Labs KelpDAO Incident Report (PDF)","type":"official","archive_url":"http://web.archive.org/web/20260727103730/https://layerzero.network/publications/kelpdao-incident-report.pdf","credibility":1,"archive_timestamp":"2026-07-27T10:37:30+00:00"},{"url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","name":"CoinDesk: Kelp claims LayerZero approved setup it blamed for $292 million bridge hack","type":"news_article","archive_url":"http://web.archive.org/web/20260801083712/https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","credibility":1,"archive_timestamp":"2026-08-01T08:37:12+00:00"},{"url":"https://www.brinztech.com/breach-alerts/brinztech-incident-report-cross-chain-bridge-configuration-flaw-leads-to-unbacked-token-minting-on-base-and-bnb-smart-chain-the-sandbox-sand-incident","name":"Brinztech Incident Report: Cross-Chain Bridge Configuration Flaw","type":"research","archive_url":"https://web.archive.org/web/20260901045251/https://www.brinztech.com/breach-alerts/brinztech-incident-report-cross-chain-bridge-configuration-flaw-leads-to-unbacked-token-minting-on-base-and-bnb-smart-chain-the-sandbox-sand-incident","credibility":2,"archive_timestamp":"2026-09-01T04:52:51+00:00"},{"url":"https://coinspectator.com/cryptonews/2026/08/30/the-sandbox-minted-329-trillion-unbacked-sand-tokens-in-5-hours-and-only-675k-was-stolen/","name":"CoinSpectator: The Sandbox minted 329 trillion unbacked SAND tokens in 5 hours and only $675K was stolen","type":"news_article","archive_url":"https://web.archive.org/web/20260901073622/https://coinspectator.com/cryptonews/2026/08/30/the-sandbox-minted-329-trillion-unbacked-sand-tokens-in-5-hours-and-only-675k-was-stolen/","credibility":2,"archive_timestamp":"2026-09-01T07:36:22+00:00"},{"url":"https://shattered.io/sandbox-sand-bridge-exploit-2026/","name":"Shattered.io: SAND Bridge Exploit — 14.9B Tokens Minted Overnight","type":"news_article","archive_url":"http://web.archive.org/web/20260825004504/https://shattered.io/sandbox-sand-bridge-exploit-2026/","credibility":2,"archive_timestamp":"2026-08-25T00:45:04+00:00"},{"url":"https://blockonomi.com/the-sandbox-sand-bridge-exploit-attacker-mints-14-9b-unbacked-tokens-on-base-network","name":"Blockonomi: The Sandbox (SAND) Bridge Exploit — Attacker Mints 14.9B Unbacked Tokens on Base Network","type":"news_article","archive_url":"http://web.archive.org/web/20260826131623/https://blockonomi.com/the-sandbox-sand-bridge-exploit-attacker-mints-14-9b-unbacked-tokens-on-base-network/","credibility":2,"archive_timestamp":"2026-08-26T13:16:23+00:00"},{"url":"https://cryptobriefing.com/sandbox-halts-bridging-sand-exploit/","name":"CryptoBriefing: Sandbox halts Base and BNB Chain bridging after exploit mints billions of unbacked SAND tokens","type":"news_article","archive_url":"http://web.archive.org/web/20260824135603/https://cryptobriefing.com/sandbox-halts-bridging-sand-exploit/","credibility":2,"archive_timestamp":"2026-08-24T13:56:03+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-08-30T12:10:08.036529+00:00","updated_at":"2026-09-01T12:55:59.702861+00:00"}}