Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #9[disputed][awaiting moderator]in section: Context: recurring LayerZero OFT exploits in 2026

   “LayerZero Labs published its KelpDAO incident report on May 18, 2026 and attributed the vulnerability to Kelp's single-verifier (1-of-1 DVN) configuration rather than the recommended multi-DVN setup.”

   reviewerLayerZero Labs published its KelpDAO incident report on May 18, 2026.The PDF itself has no extractable date, but multiple secondary outlets (URL-dated and timestamped) converge on May 20, 2026, not May 18. This looks like an off-by-two-days error.
   Proposed correction (not yet applied)

   LayerZero Labs published its KelpDAO incident report on May 20, 2026 and attributed the vulnerability to Kelp's single-verifier (1-of-1 DVN) configuration rather than the recommended multi-DVN setup.
   citedlayerzero.network/publications/kelpdao-i…ident-report.pdf
2. #10[disputed][awaiting moderator]in the timeline

   “LayerZero Labs publishes its KelpDAO incident report (stated as May 18, 2026).”

   reviewerLayerZero Labs publishes its KelpDAO incident report (stated as May 18, 2026) [timeline entry].Same underlying date error as the corresponding sentence in the Context section; grouped under the same defect_group.
   Proposed correction (not yet applied)

   LayerZero Labs publishes its KelpDAO incident report (stated as May 20, 2026).
   citedlayerzero.network/publications/kelpdao-i…ident-report.pdf

No source the reviewer could reach confirms or contradicts the claim.

1. #18[unverifiable][awaiting moderator]in section: Exploit

   “The attacker address had reportedly been dormant for 313 days before the attack, and its Relay Solver was funded 313 days before execution, which suggests deliberate pre-positioning.”

   reviewerThe attacker address had reportedly been dormant for 313 days before the attack, and its Relay Solver was funded 313 days before execution.Single-sourced, unusually specific on-chain detail that I could not independently confirm via a block explorer; the page appropriately hedges with 'reportedly,' so this is marked unverifiable rather than disputed.

The claim was accurate when written but events since have overtaken it.

1. #13[stale][awaiting moderator]in section: Actual losses versus headline figures

   “The Sandbox stated that the impact was less than 0.01% of the 3 billion SAND supply.”

   reviewerThe Sandbox stated that the impact was less than 0.01% of the 3 billion SAND supply.The 0.01% figure was the project's initial, since-superseded estimate. The page's own loss figure (~14.75M SAND of a 3B supply, ~0.5%) is internally inconsistent with asserting 0.01% as if still current, without noting the revision.
   Proposed correction (not yet applied)

   The Sandbox initially stated that the impact was less than 0.01% of the 3 billion SAND supply, a figure it revised two days later to about 0.5% (roughly 14.74 million SAND).
   citedcrypto.news/sandbox-bridge-exploit-49-bi…antom-sand-mint/
2. #14[stale][awaiting moderator]in the timeline

   “The Sandbox publicly confirms the breach, says impact is under 0.01% of total SAND supply and commits to LP compensation based on a pre-incident snapshot.”

   reviewerThe Sandbox publicly confirms the breach, says impact is under 0.01% of total SAND supply [timeline entry].Same underlying staleness as the corresponding Containment-section sentence; grouped under the same defect_group.
   Proposed correction (not yet applied)

   The Sandbox publicly confirms the breach, initially says impact is under 0.01% of total SAND supply (a figure revised two days later to about 0.5%, or roughly 14.74 million SAND) and commits to LP compensation based on a pre-incident snapshot.
   citedcoinpaprika.com/news/sandbox-halts-base-…ges-exploit-49b/
3. #17[stale][awaiting moderator]in section: Open items and unresolved questions

   “The Upbit and Bithumb reviews were ongoing, with outcomes expected in late September to early October 2026.”

   reviewerThe Upbit and Bithumb reviews were ongoing, with outcomes expected in late September to early October 2026.This section is explicitly scoped 'as of August 30, 2026,' which was accurate then, but the review period it describes as open has since closed (today is October 16, 2026) with a confirmed, materially different outcome that the page does not reflect anywhere.
   Proposed correction (not yet applied)

   The Upbit and Bithumb reviews concluded in early October 2026: both exchanges lifted their investment-warning designations on SAND on or about October 2, 2026, and SAND's price rose sharply (reports cited intraday gains of roughly 52-63%) following the announcements.
   citedwww.cryptotimes.io/2026/08/24/sand-faces…49b-mint-attack/

The cited evidence supports part of the claim but not all of it.

1. #15[partially supported][awaiting moderator]in section: Technical root cause: approveAndCall and LayerZero delegate hijacking

   “Brinztech's incident report of August 28, 2026 classified the event as a critical configuration and permission flaw in the SAND OFT bridge infrastructure.”

   reviewerBrinztech's incident report of August 28, 2026 classified the event as a critical configuration and permission flaw.The report exists, is dated August 28, 2026, and the general configuration-flaw framing is accurate, but the page's specific wording ('critical,' 'permission flaw') overstates/paraphrases the source's actual language.
   citedwww.brinztech.com/breach-alerts/brinztec…ox-sand-incident
2. #16[partially supported][awaiting moderator]in the timeline

   “Brinztech publishes (August 28) an incident report classifying the event as a critical configuration and permission flaw in the SAND OFT bridge infrastructure.”

   reviewerBrinztech publishes (August 28) an incident report classifying the event as a critical configuration and permission flaw [timeline entry].Same underlying error as the sections[1] finding; grouped under the same defect_group.
   citedwww.brinztech.com/breach-alerts/brinztec…ox-sand-incident
3. #19[partially supported][awaiting moderator]in section: Industry migration from LayerZero to Chainlink CCIP

   “As of about August 20, 2026, two days before the Sandbox incident, publicly announced migrations from LayerZero to CCIP totalled about $15 billion. The largest was BitGo's move of about $7.4 billion in wrapped Bitcoin (WBTC), and Wyoming's stablecoin infrastructure initiatives also moved to CCIP.”

   reviewerAs of about August 20, 2026, publicly announced LayerZero-to-CCIP migrations totalled about $15 billion, the largest being BitGo's ~$7.4 billion WBTC move.The $7.4B BitGo figure and general CCIP-migration narrative are accurate; the '$15 billion' total is a rounded headline number versus a body figure of ~$14.6 billion, a minor overstatement.
   citeden.cryptonomist.ch/2026/08/20/layerzero-…migration-shift/

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in section: Exploit

   “At approximately 23:42:05 UTC on August 21, 2026, an attacker began exploiting The Sandbox's SAND omnichain fungible token (OFT) contract deployed on the Base network.”

   reviewerAn attacker began exploiting SAND's OFT contract on Base at approximately 23:42:05 UTC on August 21, 2026, abusing approveAndCall to hijack LayerZero delegate permissions.Multiple independent outlets agree on the timing and mechanism. No contradicting reporting found.
   citedx.com/blockaid_/status/2091016046555582891www.cryptotimes.io/2026/08/22/sandbox-sa…-5-hour-rampage/
2. #2[confirmed][no action needed]in section: Exploit

   “By then 329.24 trillion unbacked SAND had been minted across 703 events; one account puts the recipients at 173 addresses.”

   reviewer329.24 trillion unbacked SAND was minted across 703 events, with one account citing 173 recipient addresses.Figure is corroborated by a second outlet using the same specific numbers; page correctly flags that other outlets (Cointelegraph) report a different total (339 trillion), which the page's hedged phrasing already covers.
   citedwww.cryptotimes.io/2026/08/22/sandbox-sa…-5-hour-rampage/
3. #3[confirmed][no action needed]in the summary

   “realised losses were about 14.75 million SAND drained from the Ethereum OFT Adapter and sold for roughly 80 ETH (about $675,000)”

   reviewerRealised losses were about 14.75 million SAND drained from the Ethereum OFT Adapter and sold for roughly 80 ETH (about $675,000).Core loss figure is well corroborated across multiple independent outlets and the project's own later compensation announcement.
   citedwww.cryptotimes.io/2026/08/22/sandbox-sa…-5-hour-rampage/pro.edgex.exchange/en-US/news/article/sa…9b-vs-675k-drain
4. #4[confirmed][no action needed]in section: Exploit

   “PeckShield separately counted approximately 14.9 billion SAND sent to two attacker-controlled addresses, 0xAbE0...4D22 and 0x638C...F296; the latter reportedly held about 250 million SAND at the time of reporting.”

   reviewerPeckShield separately counted approximately 14.9 billion SAND sent to two attacker-controlled addresses.Could not directly fetch the X/Twitter post (not independently browsable), but the 14.9 billion figure is corroborated by secondary reporting that explicitly attributes it to PeckShield.
   citedx.com/PeckShieldAlert/status/2091037704314339331
5. #5[confirmed][no action needed]in section: Actual losses versus headline figures

   “The minted amount exceeded the legitimate 3 billion SAND supply roughly 110,000-fold, so no market could have absorbed even a small fraction at the quoted price. EdgeX described the headline figure as 'more than 70,000 times larger than the estimated reserve drain.'”

   reviewerThe $49 billion headline figure is face value only; it is roughly 70,000+ times the actual drain and the mint exceeded real supply ~110,000-fold.Both ratios check out arithmetically (329.24T/3B ≈ 109,746x; $49B/$675K ≈ 72,600x), consistent with the quoted figures.
   citedpro.edgex.exchange/en-US/news/article/sa…9b-vs-675k-drain
6. #6[confirmed][no action needed]in section: Compensation plan

   “Eligibility is based on on-chain snapshots taken immediately before the unauthorized minting began: Base block 50,283,176 and BSC block 117,321,965.”

   reviewerOn August 27, 2026, The Sandbox announced a 1:1 compensation plan with snapshots at Base block 50,283,176 and BSC block 117,321,965, a two-week claims window, and over 72% of affected SAND held via two exchanges to be compensated directly.Verified against the cited primary news source by direct fetch; all specific figures match.
   citedwww.cryptotimes.io/2026/08/27/the-sandbo…in-sand-holders/
7. #7[confirmed][no action needed]in section: Exchange and market impact

   “Coinbase delisted SAND perpetual futures, effective August 26, 2026, as part of a batch of ten contracts that also included MEME, BIRB, BLUR, KAT, SPX, ZORA, AXS, AI and ZRO.”

   reviewerCoinbase delisted SAND perpetual futures effective August 26, 2026, in a batch of ten contracts including MEME, BIRB, BLUR, KAT, SPX, ZORA, AXS, AI and ZRO.Exact token list and date match secondary reporting; also confirmed that Coinbase framed it as a periodic review rather than citing the exploit, matching the page's hedge.
   citedcryptorank.io/news/feed/a9298-coinbase-d…ual-futures-sand
8. #8[confirmed][no action needed]in section: Context: recurring LayerZero OFT exploits in 2026

   “The attacker had earlier compromised a LayerZero Labs developer through social engineering and forged cross-chain messages through a single compromised Decentralized Verifier Network (DVN).”

   reviewerA compromised LayerZero Labs developer (social engineering, March 2026) led to session-key harvesting and a forged message via a single compromised DVN, draining ~116,500 rsETH (~$292M) from KelpDAO on April 18, 2026.LayerZero's own finalized incident report (per multiple secondary summaries) is the more authoritative, later source and supports this specific mechanism; Blockaid's earlier blog post was more speculative and is correctly superseded in the page's narrative.
   citedblockaid.io/blog/how-a-single-layerzero-…92m-from-kelpdaolayerzero.network/publications/kelpdao-i…ident-report.pdf
9. #11[confirmed][no action needed]in section: Context: recurring LayerZero OFT exploits in 2026

   “Kelp disputed this, saying LayerZero personnel had reviewed and implicitly approved the configuration across eight integration meetings over 2.5 years; LayerZero CEO Bryan Pellegrino rejected that account.”

   reviewerKelp disputed LayerZero's post-mortem, citing eight integration meetings over 2.5 years in which LayerZero reviewed and implicitly approved its configuration; LayerZero CEO Bryan Pellegrino rejected that account.The 'eight meetings / 2.5 years' detail is independently verified word-for-word; the Pellegrino attribution specifically could not be directly re-verified but is a minor, plausible detail within an otherwise well-sourced dispute.
   citedunchainedcrypto.com/kelp-dao-claims-laye…es-to-chainlink/
10. #12[confirmed][no action needed]in section: Context: recurring LayerZero OFT exploits in 2026

    “In the second incident, on or around May 27, 2026, an attacker used a compromised deployer key to reset the trusted peer on Stake DAO's LayerZero v2 vsdCRV bridge, pointing it at a malicious contract that sent forged messages. This triggered 5.4 trillion unbacked vsdCRV mints on Arbitrum and extracted about 43.78 ETH (around $91,000).”

    reviewerStake DAO's vsdCRV bridge was exploited via a compromised deployer key that reset the trusted peer, minting ~5.4 trillion unbacked vsdCRV and extracting ~43.78 ETH (~$91,000); the bridge was permanently closed.Mechanism, amounts and the no-smart-contract-bug framing are all corroborated by The Block and CryptoTimes.
    citedcryptobriefing.com/stake-dao-exploit-vsdcrv-arbitrum/www.cryptotimes.io/2026/05/27/stake-dao-…ion-fake-vsdcrv/