A bridge minted 339 trillion fake tokens — what a bridged coin really is

The Sandbox, a blockchain gaming platform, has pledged to repay affected holders one-for-one after an Aug. 21 exploit of its token bridge. An attacker drained about 14.7 million SAND, worth roughly $700,000, from an Ethereum vault by taking over the token's bridge contracts on Base and BNB Smart Chain, and minted more than 339 trillion unbacked tokens on those two networks along the way.

The failure was a configuration flaw that let the attacker become the sole verifier of incoming bridge messages. That is worth unpacking, because it explains what a bridge does. Your coin does not actually travel between chains: the original is locked or held on one chain, and a matching token is issued on the other. Whoever verifies the messages decides which issuances are real. Become the only verifier, and everything you say is real.

The damage was contained. The 14.7 million SAND taken is about 0.5% of the token's 3 billion maximum supply, and the 339 trillion unbacked tokens have been isolated so they cannot be bridged or redeemed. SAND on Ethereum and Polygon was unaffected. The Sandbox says the compromised bridge contracts will be permanently retired, and that any future Base or BNB Chain bridge would use newly deployed contracts.

For repayment, users who legitimately held bridged SAND on Base or BNB Smart Chain before the attack will receive an equal amount of Ethereum-based SAND, paid from the project's treasury with no new tokens minted. The Sandbox published its post-mortem on Thursday and expects claims to open within two weeks and stay open for two weeks after that. More than 72% of eligible balances sit at two centralised exchanges, which will distribute compensation to their own customers directly.

The lesson outlives this one token: a bridged coin is a claim, not the original. Its value rests on the bridge's accounting staying honest, which is a risk separate from the coin itself — same ticker, different guarantee. It is also worth knowing that a compensation window is exactly when fake claim pages appear. Take the claim link from The Sandbox's own official channels, expect no legitimate step to ask for your recovery phrase, and do not sign a wallet transaction you cannot read. If your balance sits at an exchange, the exchange is meant to handle it, and you may not need to claim anything at all.