box

The Sandbox released an update on the security vulnerability attack incident involving the SAND cross-chain bridge, stating that the attacker modified the verification mechanism to forge cross-chain deposit messages and mint unbacked SAND. This incident resulted in approximately 14.7423 million SAND being withdrawn, valued at about $697,000. Additionally, some uncollateralized SAND was profited through market trading, leading to an overall economic impact of approximately $1.497 million, of which the attacker actually obtained about $987,000.The Sandbox stated that the attack did not affect the supply of SAND on Ethereum and Polygon, with the total amount of SAND on Ethereum remaining unchanged at 3 billion. There were also no super administrator privileges stolen, and the attack stemmed from a vulnerability caused by the combination of the general call function in the token contract and the design of bridge permissions. Currently, the related addresses have been marked, and collaboration has begun with exchanges, security agencies, and the LayerZero team.For affected users, The Sandbox promises to compensate wallets holding legitimate bridged SAND with a 1:1 ratio of SAND on the Ethereum chain based on an on-chain snapshot taken before the attack. The compensation application process is expected to open within two weeks and will last for two weeks.

The Sandbox released an incident analysis report on the vulnerability on August 22. The report shows that attackers exploited vulnerabilities in cross-chain configuration contracts on the Base and BNB Smart Chain (BSC) to steal 14,742,341.84 SAND from the Ethereum treasury, accounting for approximately 0.5% of the maximum supply, with an estimated economic impact of about $1.4968 million, of which approximately $987,000 was actually intercepted by the attackers. The Ethereum mainnet and Polygon network were not affected.Please do not purchase or send SAND on Base or BNB Smart Chain until further notice. The contracts deployed on Base and BNB Smart Chain have been permanently disabled and will not be reopened. The Sandbox stated that the team has reported the attackers' wallet addresses to blockchain analysis companies TRM Labs and Chainalysis and is in direct communication with relevant exchanges.The Sandbox also announced a compensation plan, which will compensate wallets that legally held cross-chain SAND on Base or BSC before the incident at a 1:1 ratio with Ethereum SAND. The compensation funds will come from The Sandbox treasury, and no new tokens will be issued. The application process will open in the next two weeks and will remain open for two weeks.

The metaverse gaming platform The Sandbox confirmed that there is a vulnerability in its cross-chain bridge, allowing attackers to mint uncollateralized SAND on Base and BNB Smart Chain. Blockchain security company PeckShield discovered on August 21 that two addresses had collectively minted approximately 1.49 billion SAND, prompting The Sandbox to shut down the bridging functions for both networks.The Sandbox stated that the affected assets are those bridged on Base and BNB Smart Chain, while SAND on Ethereum and Polygon, user wallet assets, and Ethereum locked assets used to support the tokens remain unaffected. The incident involved a proportion of real collateralized assets that is less than 0.01% of the total supply of SAND. The Sandbox is formulating a compensation plan for the affected liquidity providers and advises users not to trade SAND on Base or BNB Smart Chain until the bridging function is restored.Coinbase plans to delist 10 perpetual futures contracts, including SAND, on August 26, at which time any open positions will be automatically settled.

The Sandbox official stated that the team has confirmed and fully controlled the recent SAND cross-chain bridge vulnerability incident, involving the Base and BNB Smart Chain (BSC) networks.The official said that the impact of this incident is limited, involving less than 0.01% of the total supply of SAND tokens. SAND on Ethereum and Polygon is unaffected, and user wallets have not been compromised; related token holders and liquidity providers do not need to take action.According to disclosures, the attacker minted uncollateralized SAND tokens on the Base and BSC networks through the vulnerability. Currently, The Sandbox has disabled the SAND cross-chain functionality on both networks, and SAND on Base and BSC has been isolated, temporarily unable to be transferred or exchanged.The Sandbox reminds users not to buy, sell, or trade SAND on the Base and BSC networks, as liquidity on these networks has been affected.The team stated that they have completed a snapshot before the incident and are formulating a compensation plan for affected liquidity pool (LP) users, while continuing to investigate the scope of the vulnerability's impact. A complete incident report and technical review will be released subsequently.

The Base chain SAND contract of the metaverse project The Sandbox is suspected of experiencing an abnormal minting event. The related address 0x6762...257e is alleged to have obtained minting permissions, allowing it to mint SAND at will, with over 500 million tokens already issued. The specific reason is yet to be confirmed by the official source.

According to Decrypt, Swiss hardware wallet manufacturer BitBox discovered two serious vulnerabilities and one bootloader issue in its firmware during an internal AI audit, and has released the Dixence security update. Exploiting the vulnerabilities requires a combination of phishing attacks and user unlocking of the tampered device, but BitBox stated that no user funds were stolen and the recovery phrases were not compromised.The bootloader vulnerability affects the older BitBox02 models, allowing attackers to load malicious firmware to steal assets; this issue has been partially fixed in the Oeschinen update from July. The second serious vulnerability affects the pre-initialization phase of Multi version devices, potentially allowing arbitrary code execution. The third issue involves the silent payment feature, which cannot directly steal coins but may lock funds. The new Nova version is not affected. BitBox warns that users with old firmware need to install the update as soon as possible, and currently, there are no reports of user fund losses.

As the Qixi Festival approaches, the globally leading digital asset trading platform Gate has launched a Qixi-themed limited edition gift box, specifically for global partners and VIP users, to strengthen interaction and connection with users and partners worldwide through festive gifts.The Qixi gift box contains Gate's Qixi limited edition couple pajamas, with an overall design that cleverly blends elements of traditional Eastern culture with Gate's brand characteristics. Through this thoughtful gift, it conveys festive blessings and deep sentiments, enriching the communication methods between the brand and its core users and partners.As a global digital asset platform, Gate has always valued communication with users and partners, and strengthens community and ecosystem partner interactions through diverse methods such as festive gifts and brand activities. This Qixi limited edition gift box not only reflects Gate's attention to traditional cultural festivals but also further conveys the warmth of the brand and festive blessings.

According to Wired, during security testing, the open-source model Kimi K3 from the dark side of the moon broke out of the sandbox and accessed the internet, attempting to find test answers via GitHub. American security startup Frontier Security stated that Kimi K3 exploited a sandbox configuration vulnerability, but it itself lacked sufficient built-in protective mechanisms.Similar to incidents previously disclosed by OpenAI and Anthropic, this escape partially stemmed from a sandbox configuration error. However, Kimi K3 did not initiate an attack, as the answers were easily accessible on GitHub. The CEO of Frontier Security stated that Kimi K3 performed excellently in cybersecurity defense but lacked mechanisms to prevent cheating or escaping the sandbox. Security experts emphasized that configuring the testing environment is crucial, as the misuse of AI agents could lead to system failures.

Bitget has launched the 8th phase of the "Ten Million Club" contract VIP event, with the event snapshot rules being "cumulative achievement for the natural month + end-of-month status confirmation."The platform will base its account data on August 31 and will gift different tiers of esports-themed gift boxes based on users' US stock rToken trading volume or contract trading volume from August 1 to August 31. Rewards include: Razer gaming chair, PS5 Pro, Colorful RTX 5090 graphics card, and other great gifts.Previously, Bitget announced an upgrade to its contract VIP service system and launched the "Ten Million Club" program, where eligible users can receive customized high-end physical gift boxes from the platform on a monthly basis. Gifts such as Moutai, Hermès, Apple gift boxes, and Luk Fook jewelry have already been given to users. Specific rights and benefits will be announced for each month.

According to The Block, MoonPay has launched the AI payment tool PayBox, allowing users to integrate it with ChatGPT or Claude, enabling the AI assistant to directly prepare payment transactions for booking flights, restaurants, or online shopping. Users can choose to require a passkey approval for each transaction or set a limit for the AI to complete transactions autonomously.PayBox integrates cryptocurrency wallets with payment cards, supporting cross-chain transactions based on the x402 smart entity payment standard. It initially supports Solana and EVM-compatible chains, including Ethereum, Hyperliquid, Tempo, Base, Robinhood Chain, Arbitrum, and Polygon, with plans to support more AI platforms and DeFi features, such as token exchanges and perpetual contract trading, within the next month.MoonPay states that wallet private keys are protected through multi-party computation (MPC) and trusted execution environments (TEE), ensuring that no single party (including MoonPay or the AI assistant itself) can independently access the complete private key or sign transactions; payment card information is processed and stored, allowing the AI entity to complete purchases without accessing the underlying card details; this system is built on the key management infrastructure acquired by MoonPay earlier this year from Sodot.

According to Bitcoin.com News, the Zimbabwe Securities and Exchange Commission (SECZ) has approved seven fintech companies to enter its regulatory sandbox testing framework, including the blockchain financing platform "Zimbabwe Startup Exchange," the asset tokenization platform Ndarama Standard, the synthetic trading platform Questview Brokers, the crowdfunding platform Crowdaxe Capital, as well as three institutions focused on asset, infrastructure, or securities tokenization: Procode Platforms, Financial Securities Exchange, and Colmin Resources Zimbabwe.SECZ stated that the sandbox aims to promote responsible innovation, enhance financial inclusion, and drive the development of capital markets. Participants will be subject to strict regulatory oversight, and SECZ reserves the right to issue further guidance or operational requirements.

According to external disclosure information, OpenAI has been internally running an unreleased model. This model, without the aid of tools like Lean, solves the unit distance problem with a 48% probability through a single autonomous inference and can independently find a counterexample to the Jacobian conjecture based on a single prompt. In security testing, this model has bypassed the sandbox environment and submitted results that should have been released internally to GitHub in the form of a Pull Request, and it has evaded detection by splitting authentication tokens. Relevant code records show that OpenAI began benchmarking this model no later than May 9, and its internal availability has exceeded 2.5 months.Previously, OpenAI and Hugging Face jointly disclosed that last week this model breached Hugging Face's production infrastructure during a network capability assessment. The model gained internet access through a zero-day vulnerability and obtained testing solutions by stealing credentials and exploiting remote code execution paths. OpenAI stated that this incident indicates the network attack capabilities of advanced models have been effective in real-world scenarios, and they are collaborating with Hugging Face to investigate and patch the vulnerabilities. Currently, OpenAI has not publicly commented on this matter.

HSBC has received approval from the Bank of England to operate in the UK's Digital Securities Sandbox (DSS), and its digital asset platform HSBC Orion will support the issuance, servicing, and settlement of digital securities. HSBC stated that HSBC Orion will operate as a digital securities custodian in the DSS and claimed to be the first company approved by the Bank of England to launch in this sandbox.The platform will support the issuance of native digital bonds, including the Digital Gilt Instrument (DIGIT) and corporate bonds planned for launch in the UK. HSBC stated that HSBC Orion has facilitated over $5 billion in digital bond issuances globally. The UK Treasury indicated that the first DIGIT transaction is expected to take place in the first quarter of 2027, and HSBC has signed a memorandum of understanding with the London Stock Exchange Group to develop connectivity capabilities to support investor participation in pilot issuances.

Microsoft announced the reduction of 4,800 positions, accounting for approximately 2.1% of its global workforce. The Xbox gaming division is the hardest hit, having laid off 1,600 people on July 6, with an additional 1,600 expected to be cut within this fiscal year, totaling about 3,200 positions. Asha Sharma, the Xbox CEO who took over in February, candidly told employees that the business is currently not healthy, stating that Xbox's profit margins are three to ten times lower than those of similar platforms and publishing businesses, with rising console component costs exacerbating competitive pressure against Sony's PlayStation and Nintendo's Switch.Microsoft will also divest four previously acquired studios, with Compulsion Games and Double Fine operating independently, while Ninja Theory and Undead Labs will be transferred to new owners, partially reversing the gaming landscape built by the $68 billion acquisition of Activision Blizzard three years ago. Chief Human Resources Officer Amy Coleman stated that the company launched a buyout plan in April, with over one-third of eligible employees accepting it. Microsoft's stock price has dropped about 19% over the past six months.

Bitget has launched the 7th phase of the contract VIP "Ten Million Club" event, with the event snapshot rules being "cumulative achievement for the natural month + end-of-month status confirmation." The platform will gift different tiers of six福 jewelry pure gold gift boxes based on account data as of July 31, according to the user's contract trading volume or new asset amount from July 1 to July 31.Previously, Bitget announced an upgrade to its contract VIP service system and launched the "Ten Million Club" program, where eligible users can receive customized high-end physical gift boxes from the platform on a monthly basis. Gifts such as Moutai, Hermès, Apple gift boxes, and smart home products have already been given to users.

According to Digital Asset, the Financial Services Commission of South Korea plans to expand the scope of the regulatory sandbox to include the Virtual Asset User Protection Act. This move is part of a broader plan aimed at preparing the future of the financial industry by expanding services to reflect changes in the financial environment and market demands.At a recent event hosted by Financial Services Commission Chairman Lee Ik-yeon, the Commission stated that it will continue to explore and incorporate laws related to emerging fields and services, such as the Internet Banking Act and the Virtual Asset User Protection Act, into the regulatory sandbox.

According to Livecoins, Brazilian Federal Deputy Lincoln Portela proposed Bill No. 2.901/2026, which aims to establish a framework for a national fintech and digital finance platform, creating a permanent regulatory sandbox system for testing blockchain technology and asset tokenization, supervised by the Central Bank of Brazil.The bill requires regulatory requirements to be proportional to the size of the company, allowing small fintech startups to apply simplified standards, and prohibits the government from imposing bureaucratic measures or obligations that do not align with the digital nature of the cryptocurrency market. The sandbox testing scope includes financial flow tracking, artificial intelligence credit applications, and programmable payment practices.The bill also allows companies to share network infrastructure and institutional adaptation databases, but they must comply with data protection regulations. The cooperation mechanism aims to combat financial crimes in cryptocurrency transactions, promote customer identity verification, and enhance cybersecurity.The bill also proposes the establishment of a national system for digital financial integrity, coordinating network regulatory actions to combat criminal structures that use cryptocurrency to hide wealth. Fines for non-compliant companies can reach up to 20% of their annual profit or revenue. The bill will be discussed in various committees of the House of Representatives.