Update regarding the recent SAND bridge incident. As shared this past Saturday, the exploit was rapidly contained. Since then, our team has completed the on-chain forensic investigation in collaboration with external security partners. Root cause: on Base and BNB Chain, the SAND token contract also acts as the LayerZero bridge integration. The attacker used a configuration function on that contract to register themselves as the sole verifier of incoming bridge messages, which allowed them to mint unbacked SAND on both networks. The SAND contract was audited by a third party prior to deployment, and we’re investigating why this vulnerability wasn’t identified in the audit. Confirmed Impact: full forensics show the attacker drained 14,742,341.84 SAND from the Ethereum vault backing the bridge, the real economic damage from this incident, representing roughly 0.5% of the fixed 3 billion max supply. Any additional SAND minted on Base or BSC beyond this was never backed by a deposit and cannot be redeemed against the Ethereum vault. Hence we advise against any trading of SAND on Base and BSC until further announcement. This figure is materially higher than our initial estimate on Saturday, which reflected only what was observable during the first hours of containment; we believe it's important to be transparent about that revision as the forensic investigation progresses. Ethereum and Polygon were not affected: no action is required from token holders or liquidity providers on these networks. Since Saturday, we've reported the attacker's wallet to TRM Labs and Chainalysis for stolen-funds tagging, and we've engaged directly with centralized exchanges to have deposits and withdrawals disabled on the affected networks. Bridging to and from Base and BSC remains disabled while we work through remediation. We're finalizing the full incident report and technical post-mortem. We're also evaluating remediation options for qualified users on the impacted networks, and will share further details once the scope has been finalized. We appreciate your patience and continued support. ⚠️ Reminder: our team will NEVER DM you first. Please beware of scam links in the replies.