Preview surface — demo data. Where real data exists today (e.g. RealT, BlackRock BUIDL, Lift Dollar) we render it; everywhere else we render synthetic enrichment generated deterministically from public signal and clearly marked Demo or Inferred. The Phase 3 roadmap replaces every synthetic source with live ingestion — see Methodology → Exposure Graph & Similarity Engine.
← back to incident ledger

oracle manipulationDemo

Feb 28, 2025 · $51.9M · protocol

Narrative

On 2025-02-28, The Sandbox suffered a oracle manipulation incident resulting in approximately $51,903,519 in losses. The exploit targeted the protocol layer. Attribution: whitehat. This is a demonstration entry — not a real incident.

Classification

Root cause
oracle_manipulation
Secondary causes
Attack layer
protocol
Strategy
market_manipulation
Actor role
target
Attribution
whitehat
Attacker address
0x96c9366b34b6dc2fc6fa7c003185e208da27cccc
Flash loan
no
Audited at time
no
Bounty at time
no

AADAPT mappings

DEMO:AADAPT.TA0040DEMO:AADAPT.TA0007DEMO:AADAPT.T1499.001DEMO:AADAPT.T1565.003

Evidence

Disclosure date
Mar 3, 2025
Funds recovered
Audit firms at time
Post-mortem URLs (synthetic)
  • https://medium.com/the-sandbox/post-mortem-the-sandbox-2025-02-28
tx hashes (4)
  • 0xfe98505d1b21ba9f8d0457337c89925d627c6a3ff32354b4730673ef8525a192
  • 0x524aee49a50ecbe8caac1890c300a1f163b358a05c386ca2e4d8d8ce91a6ed34
  • 0x1e97716b3ccc9978fb8fa2920176f8cf871bed49062ea67a89258630aad20e15
  • 0xd1755c01847b3d6e1ed93d7292db5286dda7852046b67a13f06dae314b18fb1c