Nikolas Sargeant
TL;DR
-
The Sandbox suspended SAND bridging on Base and BNB Smart Chain after an attacker minted unbacked tokens.
-
The exploit generated tokens with a theoretical market value of approximately $49 billion, but that figure does not represent actual losses or funds stolen.
-
The company said the incident affected less than 0.01% of SAND’s 3 billion-token supply, although it did not clarify how that figure was calculated.
The Sandbox Suspends Bridging After Security Exploit
The Sandbox halted SAND token bridging on Base and BNB Smart Chain after discovering an exploit that allowed an attacker to create unbacked tokens on both networks.
The blockchain gaming and metaverse project disabled transfers to and from the affected chains, preventing SAND tokens on those networks from being moved or redeemed through the bridge.
Users were also warned not to buy, sell, or trade SAND on Base or BNB Smart Chain because liquidity had been compromised.
The company said SAND on Ethereum and Polygon was unaffected and emphasized that no user wallets were compromised.
Initial reports suggested the attacker minted tokens with a theoretical value of approximately $49 billion across more than 400 transactions.
However, that figure does not represent money stolen, confirmed user losses, or an amount the attacker could realistically withdraw.
It was calculated by applying SAND’s market price to tokens created without backing, even though the available trading liquidity was far too limited to support sales at that scale.
For context, SAND’s entire market capitalization is approximately $136 million, making the reported nominal value of the unauthorized tokens vastly larger than the market value of its legitimate circulating supply. The actual financial impact has not been clearly established.
Exploit Allegedly Targeted LayerZero Delegate Permissions
Blockchain security company Blockaid flagged the attack while it was underway. The firm said the attacker hijacked LayerZero delegate permissions through an approveAndCall function, allowing unauthorized SAND tokens to be minted on the affected networks.
🚨 Blockaid detected an ongoing exploit on @TheSandboxGame SAND OFT on Base.
— Blockaid (@blockaid_) August 22, 2026
Attackers hijacked LayerZero delegate permissions via approveAndCall and minted unbacked SAND.
~$49B face-value SAND minted so far across ~400+ txs. Attack still ongoing.
More details in 🧵
Blockchain security firm PeckShield separately identified approximately 14.9 billion SAND minted across two addresses.
The different estimates were reported at separate stages of the incident and reflect the number or nominal value of unauthorized tokens rather than confirmed financial losses.
The 14.9 billion-token figure also exceeds SAND’s stated 3 billion-token supply, highlighting that the exploit created unbacked assets outside the intended token issuance framework.
The Sandbox said the exploit’s impact represented less than 0.01% of SAND’s total supply. With a maximum supply of 3 billion tokens, that percentage would equate to fewer than 300,000 SAND.
However, the company did not define what it meant by “impact” or explain how that figure relates to the much larger number of unbacked tokens reportedly minted.
The statement may refer to actual economic losses, affected liquidity or another measure, but The Sandbox has not provided sufficient information to confirm the calculation.
Until the company releases additional details, the distinction between unauthorized token creation and realized financial damage remains unresolved.
Ethereum and Polygon Tokens Remain Unaffected
The Sandbox said the exploit was limited to SAND tokens on Base and BNB Smart Chain.
SAND held on Ethereum and Polygon was not affected. The company also said the SAND locked on Ethereum to support legitimate bridged tokens remains intact.
No user wallets were compromised, suggesting the incident was linked to bridge-related permissions rather than the theft of users’ private keys.
However, bridging on Base and BNB Smart Chain remains suspended while the company investigates and works to contain the incident.
South Korean cryptocurrency exchanges Bithumb and Upbit suspended SAND deposits and withdrawals after citing suspected security concerns.
Bithumb and Upbit announced the restrictions as the situation unfolded. The exchanges did not indicate when normal deposit and withdrawal services would resume.
Such suspensions are commonly used to prevent potentially compromised assets from entering or leaving trading platforms while an incident is assessed.
The Sandbox said it is taking a snapshot of network activity from before the exploit. The snapshot will help identify users eligible for compensation related to affected liquidity pools.
The company has not disclosed how much compensation may be available or when distributions could begin.
It also plans to publish a technical postmortem explaining how the exploit occurred and outlining its response.
SAND fell nearly 10% during the trading session after the incident became public but later recovered much of the decline, leaving the token down approximately 0.8% over the previous 24 hours.
