The Sandbox released an incident analysis report on the vulnerability on August 22. The report shows that attackers exploited vulnerabilities in cross-chain configuration contracts on the Base and BNB Smart Chain (BSC) to steal 14,742,341.84 SAND from the Ethereum treasury, accounting for approximately 0.5% of the maximum supply, with an estimated economic impact of about $1.4968 million, of which approximately $987,000 was actually intercepted by the attackers. The Ethereum mainnet and Polygon network were not affected.

Please do not purchase or send SAND on Base or BNB Smart Chain until further notice. The contracts deployed on Base and BNB Smart Chain have been permanently disabled and will not be reopened. The Sandbox stated that the team has reported the attackers’ wallet addresses to blockchain analysis companies TRM Labs and Chainalysis and is in direct communication with relevant exchanges.

The Sandbox also announced a compensation plan, which will compensate wallets that legally held cross-chain SAND on Base or BSC before the incident at a 1:1 ratio with Ethereum SAND. The compensation funds will come from The Sandbox treasury, and no new tokens will be issued. The application process will open in the next two weeks and will remain open for two weeks.