The Sandbox set out a compensation plan for its August 22 bridge exploit on Thursday, saying every wallet that legitimately held bridged SAND on Base or BNB Smart Chain will be repaid 1:1 in SAND on Ethereum, with a claim window opening within two weeks and remaining open for two weeks thereafter.
The plan states that entitlements are already fixed. They are determined from balances recorded on-chain immediately before the first unauthorized mint, at Base block 50,283,176 and BSC block 117,321,965, meaning nothing a holder has done since the exploit affects what they are owed.
How Holders Get Paid
Most affected users will not have to do anything. Two centralized exchanges account for more than 72% of the affected balance, and The Sandbox says it is in direct contact with both, with compensation to be made through the exchange rather than by individual claim.
For everyone else, the company will publish the full entitlement list as an X article and a blog post alongside the claim information, so holders can verify their own balance before claiming.
The mechanics are deliberately narrow. Claiming requires only a transaction from the wallet that held the SAND at the snapshot. It does not require approving a token, signing an off-chain message, or sending anything anywhere.
That specificity is a scam countermeasure. The Sandbox warns that neither it nor Animoca Brands will ever message holders first offering to recover, swap, or unlock tokens, and that any such approach is fraudulent. Compensation will be based on balances already recorded on-chain and announced only through official channels.
Missing the window is not fatal. Holders who do not claim on Ethereum within the next few weeks keep their entitlement, and the same amount will be made available on Base and BNB Smart Chain once replacement contracts are deployed.
Funded From Treasury
All compensation comes from The Sandbox treasury. No new SAND will be minted, and the Ethereum supply remains 3,000,000,000 tokens—unchanged before, during, and after the incident.
That matters for holders on unaffected networks. SAND on Ethereum and Polygon was never touched; Polygon uses a separate bridge outside the affected path. Holding, transferring, staking, and trading on either network are unaffected and require no action.
The Contracts Are Not Being Fixed
The more consequential decision is what happens to the bridge itself. The contracts on Base and BNB Smart Chain are permanently retired and will not reopen.
The Sandbox gives two reasons. There is no proxy, so the function the attacker used is fixed in deployed bytecode and cannot be removed, disabled, or patched—anything deployed to fix it has to be a new contract. And control over the bridge configuration cannot be durably held: the same design flaw means the configuration role can be taken again by anyone willing to pay the gas, however many times it is reclaimed.
Reclaiming would create the appearance of control rather than actual control, which is why the company says it has not done so and why reopening would be unsafe in any configuration. Tokens sent to the closed bridge contracts will be destroyed with nothing released in return.
Bridging to those networks may resume in future, but only through newly deployed contracts at new addresses, which will be announced through official channels. The replacement architecture separates the token and the bridge application into different contracts so that no contract holding a general-purpose call function is also a privileged participant in the bridge—the specific combination that made the attack possible.
What Happens to the Unbacked Tokens
More than 339 trillion unbacked SAND now exists on Base and BNB Smart Chain, against a real supply of three billion.
The Sandbox says those tokens are stranded three ways: the bridge route is set to zero so they cannot move to another chain, the send function is disabled, and the vault they could once be redeemed against is closed. No further unbacked SAND can be minted.
The company advises against buying SAND on either network until further notice, noting that whatever price is quoted for those tokens is not a real price.
Where the Investigation Stands
Attacker addresses have been flagged with SEAL, TRM, and Chainalysis, and major exchanges have suspended SAND deposits and withdrawals on the affected chains. The Sandbox says it has approached the attacker regarding a whitehat return, and that the bridge’s status remains under review with no reopening decision made.
Proceeds remain unmoved. Two Ethereum addresses hold 396.60 ETH and 9.95 ETH at nonce 3, with only gas residue left on Base.
The exchange response has run ahead of the compensation plan. Upbit designated SAND an investment warning asset effective August 24, opening a review that could end in termination of trading support by early October, with Bithumb conducting a parallel review in late September. Whether compensation delivered inside the claim window influences those reviews is the open question for holders.
The post-mortem also revises the loss figures reported at the time. Bridge users lost 14,742,341.84 SAND, approximately $697,000, against a total economic impact of roughly $1,496,784—with the largest single component, around $760,000, falling on traders in a Base decentralized exchange pool. The Sandbox contained the exploit on August 22, closing the bridge at contract level across all three chains at 05:26 UTC.
