The Sandbox released an update on the security vulnerability attack incident involving the SAND cross-chain bridge, stating that the attacker forged cross-chain deposit messages to mint unbacked SAND after modifying the verification mechanism. This incident resulted in approximately 14.7423 million SAND being withdrawn, valued at about $697,000. Additionally, some uncollateralized SAND was profited through market trading, leading to an overall economic impact of about $1.497 million, of which the attacker actually obtained about $987,000.

The Sandbox stated that the attack did not affect the supply of SAND on Ethereum and Polygon, with the total amount of SAND on Ethereum remaining unchanged at 3 billion. There were also no super administrator privileges stolen. The attack stemmed from a vulnerability caused by the combination of the general call function in the token contract and the design of bridging permissions. Currently, the related addresses have been flagged, and collaboration has begun with exchanges, security agencies, and the LayerZero team.

For affected users, The Sandbox promises to compensate wallets holding legitimate bridged SAND at a 1:1 ratio with Ethereum chain SAND based on an on-chain snapshot taken before the attack. The compensation claim process is expected to open within two weeks and will last for two weeks.