The Sandbox has released its post mortem on the bridge exploit, and the document lays out an attack that was engineered down to the last hundred tokens. The vulnerability was exploited on Friday, August 21, 2026 at 23:41 UTC, with the bridge closed at contract level across all three chains on August 22 at 05:26 UTC.

Total estimated economic impact came to approximately 1,496,784 USD, of which the attacker successfully captured around 987,000 USD.

The Four Steps

The token contract on Base and BNB Smart Chain carried a convenience feature letting anyone ask the token to make a call on their behalf, intended to save users a transaction. Because that same token contract was also the bridge's registered application on those chains, the messaging layer treated anything originating from it as an instruction from The Sandbox itself.

Step one used that call mechanism to make the token contract submit a request registering an attacker controlled address as authorised administrator. The bridge accepted it because it came from the registered contract.

Step two used those rights to change the verification configuration for incoming messages, making the attacker the sole verifier with a single verification sufficient to confirm a transaction.

Step three submitted bridge messages representing Ethereum deposits that never happened. They verified under the altered configuration, and SAND was issued on both chains with nothing backing it.

Step four realised the value two ways: selling unbacked SAND on Base for real ETH, and burning unbacked SAND to trigger reverse bridge transactions that released real SAND from the Ethereum vault.

The Sandbox was explicit that no keys were compromised, lost, or used by unauthorised parties. No new privileged account was granted, and no super operator was added on either chain, verified against the attacker address, both attacker controlled delegate contracts, the token contract, and the governance multi signature wallets. The LayerZero delegate roles were reassigned by the token contract acting on the attacker's instruction, not obtained through a key.

Sized to Leave 100 Tokens Behind

The precision in the post mortem is what stands out. Thirty nine blocks after the first unbacked mint, the attacker minted 14,743,364.21 SAND, exactly 100 SAND less than the 14,743,464.21 the vault held at that moment.

That amount was bridged to Ethereum and the vault drawn down across six withdrawals, the last sized to leave precisely 100 SAND behind.

The plan did not fully land. Forty eight minutes before the attacker's own messages cleared, an unrelated arbitrage bot redeemed 642,471.52 unbacked SAND it had bought on the open market, and two smaller withdrawals took a further 5,409.03. The attacker ended up receiving 14,095,483.66 SAND, short by 647,880.55.

That detail exposes the structural flaw underneath everything else. Nothing about the return trip was forged. The burns were real, the messages were verified by normal validators, and LayerZero's own delivery service carried them. A lock and release vault has no way to confirm whether the tokens being burned were ever backed, which is why a third party could redeem unbacked SAND exactly as easily as the attacker could.

Draining a Pool for Twenty Times Its Depth

The selling side was equally deliberate. The attacker moved 93,415,334.861816 SAND across 26 sales, all into a single Aerodrome Slipstream SAND and WETH pool, for proceeds of 327.592005773324842721 wrapped ether.

That pool held only 16.272817 wrapped ether when the attack started. Extracting more than twenty times its entire depth worked because each sale was programmed as an exact output swap requesting roughly 90 percent of the ether available at that instant, after which arbitrage bots bought the crashed token and refilled the ether side. The attacker repeated this 21 consecutive times, pulling 313.32 wrapped ether back in from 79 trading contracts operated by 534 separate accounts.

The mechanism visibly broke down at the end. The 22nd attempt returned 86.8 percent of the pool, then 83 percent, then 67.6 percent. The final two sales put 30.5 million SAND in for 0.000036 wrapped ether combined.

Why the Contracts Can Never Be Reopened

The Sandbox stated plainly that there is no configuration of these contracts in which reopening the bridge is safe, and gave two reasons.

The contracts are not upgradeable. There is no proxy, so the function the attacker used is fixed in deployed bytecode and cannot be removed, disabled, or patched.

Control over the bridge configuration also cannot be durably held. The same design that allowed the attack means the configuration role can be retaken by anyone willing to pay gas, however many times it is reclaimed. Reclaiming it would create the appearance of control rather than actual control, which is why the studio has not done so.

The unbacked tokens are stranded. The bridge route is set to zero, the send function is disabled, the vault they could be redeemed against is closed, and no further unbacked SAND can be minted. More than 339 trillion unbacked SAND now exist on those two networks against a real supply of 3 billion, and any price quoted for them is not a real price.

The replacement architecture separates the token and the bridge application into different contracts, so no contract holding a general purpose call function is also a privileged bridge participant. The studio described this as making the attack structurally impossible rather than merely guarded against.

Compensation and What Holders Should Do

Every wallet holding legitimately bridged SAND on Base or BNB Smart Chain immediately before the incident will be compensated 1:1 in SAND on Ethereum. Entitlements come from balances recorded at Base block 50,283,176 and BSC block 117,321,965, taken before the first unauthorised mint.

The snapshot is independent of user action, so nothing a holder has done since the exploit changes their entitlement. All compensation is funded from The Sandbox treasury with no new SAND minted, and Ethereum supply remains exactly 3,000,000,000 tokens.

Two centralised exchanges account for over 72 percent of the affected balance, and both are already in direct contact with the studio so their users are made whole through the exchange rather than claiming individually. Everyone else gets a claim process opening within two weeks and staying open for two weeks after, with the full entitlement list published so holders can verify their own balance first. Claiming requires only a transaction from the wallet that held the SAND at snapshot, with no token approval, no off chain signature, and nothing sent anywhere.

Anyone who does not claim in that window keeps their entitlement, which will be made available on Base and BNB Smart Chain once replacement contracts are deployed at new addresses.

The studio also warned that neither Animoca Brands nor The Sandbox will ever message a holder first offering to recover, swap, or unlock tokens, and that no legitimate recovery requires connecting a wallet or sending funds.

The attacker's addresses have been flagged with SEAL, TRM, and Chainalysis, exchanges have suspended SAND deposits and withdrawals on the affected chains, and The Sandbox has reached out to the attacker regarding a whitehat return.