The Sandbox Bridge Exploit Mints 329 Trillion Phantom SAND Tokens, $675K Stolen

A bridge configuration flaw on Base and BNB Smart Chain let attackers hijack LayerZero delegate permissions, mint 329.24 trillion unbacked SAND tokens and extract about $675,000 from the Ethereum vault. The Sandbox responded by disabling the affected bridges and pledging reimbursement for eligible holders.

How the Exploit Worked

The attacker abused the approveAndCall function on The Sandbox’s SAND omnichain fungible token (OFT) contract deployed on Base. By sending a crafted payload, they seized the delegate address that controls LayerZero endpoint settings on the destination chain. With that control, the attacker could approve fraudulent bridge messages and mint tokens without a corresponding burn on the source chain.

Scale of the Minting vs. Actual Loss

Over roughly five hours on August 21‑22, 2026, the attacker created 329.24 trillion SAND across 703 events. Security firm Blockaid estimated a face‑value of about $49 billion based on market price, but the tokens were essentially worthless because the bridge was disabled before any redemption could occur.

The real financial damage was the extraction of approximately 14.75 million SAND (about 80 ETH) from the Ethereum OFT Adapter, valued at roughly $675,000. The attacker sold the tokens in 26 transactions, each sized to drain most of the available ether from the liquidity pool before it could recover.

Immediate Response

The Sandbox team shut down bridging on Base and BNB Smart Chain, removed LayerZero peer settings via multisig governance, and confirmed that SAND on Ethereum and Polygon remained untouched. No private keys or user wallets were compromised.

Eligible holders will be reimbursed 1:1 from the project treasury, with a claims portal expected within two weeks of the August 27 post‑mortem.

Market Reaction and Wider Impact

• South Korean exchanges Upbit and Bithumb suspended SAND deposits and withdrawals; Upbit also froze SAND transfers on Ethereum.
• Coinbase delisted SAND perpetual futures contracts.
• SAND price fell nearly 10 % intraday but recovered most of the loss within 24 hours, ending the day down 0.8 %.
• The incident marks the third major LayerZero‑related bridge failure in five months, prompting a $15 billion migration from LayerZero to Chainlink CCIP by projects such as BitGo, Mantle and Lombard.