Upbit lifts caution label on The Sandbox's SAND after 39 days, deposits to reopen soon

Upbit lifted The Sandbox (SAND)'s designation as an investment caution asset at 4 p.m. KST on Oct. 2, 39 days after the South Korean exchange imposed it on Aug. 24. In its notice, Upbit said it had "received and reviewed materials on the circumstances of the security incident and the follow-up response" through a review process with The Sandbox, and concluded that the reasons for the designation had been resolved. SAND deposits, which had been blocked, will reopen soon.

From a bridge exploit to a caution label

The Sandbox is a metaverse gaming platform, and SAND is the token used in its game. The trouble started in its bridge, the infrastructure that moves SAND from Ethereum to other blockchains. According to a post-mortem The Sandbox published on its official X account on Aug. 27 and Upbit's notices, events unfolded as follows.

1. Aug. 22, 08:41 KSTAttacker begins minting unbacked SAND on Base and BNB Smart Chain
2. Aug. 22, 11:12 KSTUpbit suspends SAND deposits and withdrawals
3. Aug. 22, 14:26 KSTThe Sandbox closes the bridge at contract level on all three chains
4. Aug. 24, 15:00 KSTUpbit designates SAND as an investment caution asset (SAND/KRW, SAND/BTC)
5. Sept. 9Upbit resumes withdrawals only, for SAND on the Ethereum network
6. Oct. 2, 16:00 KSTUpbit lifts the designation

When it imposed the designation, Upbit cited a hack or other security incident whose cause had not been identified or remedied. The designation period was set to run through the last week of September (Sept. 28 to Oct. 4), and Upbit said trading support could end if the issues were not resolved. On the day of the designation, Upbit's SAND daily candle (starting at 9 a.m. KST) fell 22%, from 61.5 won to 48.0 won.

SAND on Ethereum was never touched

According to the post-mortem, the attacker used a convenience feature in the SAND token contracts on Base and BNB Smart Chain to seize the bridge's administrator privileges. The attacker then minted SAND on both chains that had never been deposited on Ethereum, sold part of it for ether (ETH) on a decentralized exchange on Base, and sent another part back to the Ethereum vault to withdraw real SAND. A total of 14,742,341.84 SAND left the vault, worth about $697,000 at the time.

The Sandbox estimated the overall economic impact at about $1.497 million, of which the attacker captured $987,000. The company said no keys it held were compromised, SAND on Ethereum and Polygon was unaffected, and the total supply of Ethereum SAND remains unchanged at 3 billion tokens. Wallets that held legitimately bridged SAND on Base or BNB Smart Chain immediately before the incident will be compensated 1:1 in SAND on Ethereum, funded from The Sandbox treasury, with no new SAND minted. The company added that more than 72% of the affected balance sat on two centralized exchanges, whose users will be compensated directly through the exchange.

An 86% jump within a day of the lifting

In the 4 p.m. KST hour on Oct. 2, when the notice was posted, SAND on Upbit rose from the 65-won range to as high as 83.5 won. In the 2 p.m. hour the next day, Oct. 3, it hit 114 won, 86% above its Oct. 1 close of 61.4 won. Upbit's SAND trading volume, which had been around 2 billion won a day, swelled to 229.5 billion won in the 24 hours from 9 a.m. KST on Oct. 2. The rally also showed up overseas: on Binance, SAND climbed from $0.0482 to $0.0613 in the same 4 p.m. KST hour.

At 10:30 a.m. KST on Oct. 5, SAND traded at 100 won on Upbit and 99.67 won on Bithumb. Binance's price of $0.07375 converts to about 99.2 won, putting the kimchi premium (the gap between prices on Korean exchanges and global markets) at about 0.8% on Upbit. At the same time, the funding rate on Binance's SAND perpetual futures stood at -0.09%, meaning short positions were paying long positions.