
The Sandbox's cross-chain bridge on Base and BSC was exploited, minting 14.9B unbacked SAND. Only $675K in backed tokens was drained; exchanges suspended deposits. Full post-mortem pending.
The Sandbox, the blockchain-based metaverse platform, suffered a security breach involving its cross-chain bridge on Base and BNB Smart Chain. An attacker exploited a vulnerability in the token's LayerZero-based Omnichain Fungible Token (OFT) setup to mint roughly 14.9 billion SAND tokens without proper collateral.
Security firms Blockaid and PeckShield flagged unusual activity around Aug. 21–22. The attacker used the approveAndCall function to generate tokens on the secondary chains while the corresponding SAND remained locked on Ethereum, researchers said. The Sandbox team said it identified and fully contained the issue. Bridging functions to and from Base and BSC were disabled, effectively isolating the unbacked tokens.
Despite the large nominal mint, the real financial loss was limited. Only about 14.75 million legitimately backed SAND, worth roughly $675,000 at the time, left the Ethereum-side bridge adapter, along with a small amount of ETH. The Sandbox assessed the overall impact at less than 0.01% of the token's total supply of 3 billion.
SAND on Ethereum and Polygon remained completely unaffected. No individual user wallets were compromised. Major South Korean exchanges Upbit and Bithumb suspended SAND deposits and withdrawals. The Sandbox said it captured a pre-incident snapshot of balances and is preparing a compensation framework for eligible liquidity providers affected by the event.
The team pledged to release a full technical post-mortem once its investigation concludes. Community members affected by liquidity pool disruptions were directed to contact official support channels.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.