The Sandbox Contained Bridge Exploit Minting Unbacked SAND on Base and BSC

The Sandbox announced that it has identified and fully contained a vulnerability in its SAND cross‑chain bridge that allowed an attacker to mint unbacked SAND on the Base and BNB Smart Chain (BSC) networks. The studio has disabled bridging to and from both chains, leaving the affected SAND tokens isolated.

Bridge vulnerability and containment

The exploit involved hijacking LayerZero delegate permissions via the approveAndCall function on SAND’s omnichain fungible token contract on Base. The delegate role controls who can mint new tokens on a given chain. The Sandbox confirmed that SAND on Ethereum and Polygon remains unaffected and that the backing assets locked on Ethereum are intact.

Scale of the minting

Security firms reported differing figures for the amount of SAND minted:

• Blockaid estimated roughly $49 billion worth of SAND minted across more than 400 transactions.
• PeckShield identified 14.9 billion SAND minted to two addresses, far exceeding the token’s circulating supply of about 2.94 billion.

The Sandbox described the impact as “less than 0.01 % of total SAND supply,” without providing a dollar‑value loss.

Exchange reactions in South Korea

Two South Korean exchanges froze SAND transfers under the Virtual Asset User Protection Act:

• Upbit suspended deposits and withdrawals on the Ethereum network and issued a trading caution, citing a suspected security incident.
• Bithumb halted deposits and withdrawals, while keeping trading open, and warned of potential price volatility.

Both exchanges said services will resume once network stability is confirmed.

Market response and next steps

Despite the incident, SAND traded at $0.0479, up 4.6 % over 24 hours and 22 % over seven days, giving the token a market cap of roughly $140.8 million.

The Sandbox plans to snapshot pre‑incident positions and develop a compensation plan for qualified liquidity‑pool users. A full incident report and technical post‑mortem are also promised.