In August, the Sandbox project began accepting compensation claims from users who lost access to the $SAND network due to a hack.
The decision to compensate users comes at a time when hardware wallet manufacturers Ledger and Trezor are warning that the next wave of vulnerabilities is approaching at such a speed that security specialists cannot patch them fast enough.
Sandbox Reopens Claim Window
Sandbox shared information on X on September 8, stating that anyone who held bridged $SAND on Base or $BNB Smart Chain prior to the August 22 vulnerability can now apply for a full 1:1 refund, payable in $SAND on Ethereum.
The message stated that individual wallet holders need to apply via the project's portal, while users holding tokens on an exchange need do nothing.
An analysis of the testnet situation found that the lost funds amounted to approximately $697,000, according to Cryptopolitan. Balances on Ethereum and Polygon were unaffected, and Ethereum still holds 3 billion tokens.
Currently, $SAND shares are trading at approximately $0.041, up more than 2.7% in the last 24 hours. However, it's worth noting that they are still significantly below their November 2021 all-time high of $8.44.
How Did the Attack on Sandbox's Bridge Occur?
Analysis of the situation pointed to tracked $SAND tokens in the Base and $BNB Smart Chain networks, which were configured as registered bridge applications, allowing users to bypass redundant transactions. The message-passing layer interpreted any request from this source as an order from Sandbox.
The attackers registered their address as an administrator, relaxed the settings so that a single self-confirmation would clear a bridge message, created $SAND tokens based on deposits that were never made, and then reverse-converted real tokens from the Ethereum treasury.
The investigation determined that the amount withdrawn from the treasury was 14,742,341.84 $SAND, with the total economic damage approaching $1.49 million. On August 22, Sandbox closed the bridge across all three chains.
The Sandbox team ruled out the possibility of reopening the bridge, stating that control over the compromised trackers "may be contested forever."
Cronos Recovers from Tectonic Plunge
Another project, Cronos, which suffered an attack in late August, appears to have made further progress in its recovery. As reported by Cryptopolitan.
It was reported that within 20 minutes, the attacker artificially inflated the price of the low-liquidity TONIC token by approximately 100 times. He then borrowed real assets using the inflated value as collateral.
As confirmed by PeckShield, the chain halt worked: of the approximately $75 million at risk, only about $6 million made it to Ethereum before the chain stopped.
Crypto.com CEO Kris Marszalek stated that the exchange and app were not hacked. Since then, Cronos has resumed operations, and the Total Value Locked (TVL) in Tectonic, which had dropped from approximately $122 million to under $3 million, has exceeded $121 million again.
Ledger and Trezor Publish Materials on Private Investigative Journalism
While platforms work on compensating affected users for losses, two of the industry's most renowned cold wallet manufacturers, Ledger and Trezor, have drawn attention to some security issues platforms face, particularly regarding vulnerability disclosure.
Charles Guillemet, CTO of Ledger, stated that AI has made vulnerability discovery cheap. In his post on X, Guillemet noted that the adoption of AI has also stripped security professionals of the advantage they once had.
He pointed out the fact that some researchers now publish their findings before a fix is found, which he called "attention-seeking at the expense of others' risk."
Regarding the disclosure process, he urged researchers to report issues privately and establish fixed deadlines first, naming 90 days as a common default period, which can vary depending on the severity of the issue. Trezor supported Guillemet's comments on X, stating they firmly support responsible disclosure.
Jan Komarek, Head of Security at Trezor, shared his perspective, stating: "The 90 days are the vendor's commitment, not just the researcher's." He added that researchers can publish their results even if the vendor doesn't meet the deadline.
These actions followed data thefts via Coldcard exceeding $100 million and a breach of Trezor's payment provider system that exposed tens of thousands of customers' data.
end-content
