The Sandbox is compensating victims of the hacker attack on its cross-chain bridge.

The team behind the popular metaverse, The Sandbox, announced plans to fully refund users affected by a recent hacker attack. The incident, which occurred on August 21, resulted in the compromise of cross-chain bridge smart contracts and the theft of a significant amount of digital assets. The project's leadership assured the community that all legitimate token holders will receive compensation.

The attack targeted exclusively SAND token contracts deployed on the Base and BNB Smart Chain networks. The hackers discovered a critical vulnerability in the bridge's messaging architecture that allowed the system to misinterpret any third-party commands as direct and legitimate instructions from The Sandbox platform itself.

Taking advantage of this technical flaw, the attackers assigned their own addresses as authorized administrators and generated a series of fake deposit messages. This allowed them to issue unbacked tokens on the Base and BSC networks and then, via the reverse bridge function, withdraw real assets from the main vault.

According to a technical analysis, the hackers withdrew 14,742,341 SAND tokens from the pool during the attack, which was valued at approximately $697,000 at the time of the theft. Analysts estimate the total damage to the ecosystem as a result of the multi-stage scheme at nearly $1,49 million.

Despite the seriousness of the situation and the financial losses, the developers responded quickly to the threat and presented a transparent compensation plan. Users who held legitimate SAND tokens on the vulnerable Base and BSC networks at the time of the hack will receive a 100% refund at a 1:1 ratio.

Payments will be made in native ERC-20 tokens based on the Ethereum network . Compensations will be allocated from the project treasury without the additional issuance of new coins, preventing inflationary pressure on the asset. The reimbursement application process will open for two weeks, starting on August 27, and will last for another 14 days. It will take approximately one month for funds to be credited to users' wallets.