The Sandbox Contains Cross-Chain Bridge Exploit After Unbacked SAND Minted on Base and BSC

The Sandbox announced that it has successfully contained a vulnerability in its SAND cross-chain bridge on the Base and BNB Smart Chain (BSC) networks. The incident occurred after an attacker managed to mint unbacked tokens on both networks.

Details of the Exploit and Impact

Security firm Blockaid first flagged the incident, reporting that attackers hijacked LayerZero delegate permissions via the approveAndCall function. Blockchain security alerts tracked billions of face-value SAND minted across multiple transactions and addresses.

Despite the large face-value amount minted, The Sandbox stated that the actual impact is under 0.01% of the total SAND supply. The project confirmed that tokens on Ethereum and Polygon remain entirely unaffected and that no user wallets were compromised. Furthermore, the SAND locked on Ethereum, which backs all bridged tokens, remains intact.

Response and Exchange Reactions

In response to the exploit, the project disabled bridging to and from Base and BSC. This action isolates the affected tokens, preventing them from being moved or redeemed. The Sandbox advised holders not to buy, sell, or trade SAND on Base and BSC due to compromised liquidity. Additionally, the team is preparing a pre-incident snapshot and compensation for qualifying liquidity providers, alongside a full post-mortem.

South Korean cryptocurrency exchanges also reacted to the security incident. Bithumb suspended SAND deposits and withdrawals, followed shortly by Upbit under South Korea's Virtual Asset User Protection Act. Upbit's halt included the Ethereum version of SAND, despite the project clarifying that Ethereum tokens were never at risk.