The Sandbox Halts SAND Bridging Following Exploit Minting Billions of Unbacked Tokens

The exploit underscores vulnerabilities in cross-chain protocols, potentially shaking investor confidence in Web3 gaming assets.

• The Sandbox suspended cross-chain bridging for SAND tokens on Base and BNB Smart Chain on August 22, 2026, after an exploit.
• An attacker minted approximately 14.9 billion unbacked SAND tokens, valued at around $49 billion, by hijacking delegate permissions.
• No user wallets were compromised, and the project is assessing the impact, which is less than 0.01% of the total SAND supply.

• LayerZero’s OFT standard allows for cross-chain token transfers without traditional lock-and-mint mechanisms, increasing efficiency but also risk.
• Previous incidents, like the KelpDAO bridge exploit, highlight ongoing vulnerabilities in similar infrastructures.
• The Sandbox maintains primary SAND reserves on Ethereum, with bridged tokens on secondary networks, making it crucial to isolate affected tokens.

On August 22, 2026, on-chain monitoring by Blockaid and PeckShield revealed unusual minting activity on the Base and BNB Smart Chain networks. An attacker exploited a vulnerability in The Sandbox's cross-chain bridge, specifically targeting the LayerZero Omnichain Fungible Token (OFT) standard. By compromising delegate permissions through the approveAndCall function, the attacker was able to mint approximately 14.9 billion SAND tokens across hundreds of transactions. Although the face value of these tokens was estimated at $49 billion, the actual extractable value was limited, with only about 14.75 million SAND transferred to usable addresses.

In response, The Sandbox immediately disabled bridging to and from both networks, isolating the unbacked tokens and rendering them non-transferable and non-redeemable. This swift action was crucial in preventing further exploitation and protecting user funds, as the project confirmed that no user wallets were compromised. South Korean exchanges Upbit and Bithumb responded by suspending SAND deposits and withdrawals, reflecting the immediate market impact of the exploit.

The incident has raised questions about the security of cross-chain protocols, particularly those utilizing LayerZero's infrastructure. While the project emphasized that the overall supply impact was minimal and that reserves on Ethereum remained intact, the incident has nonetheless put a spotlight on the vulnerabilities inherent in decentralized finance systems. The Sandbox is now focused on assessing the full impact of the exploit and has committed to compensating liquidity providers based on pre-incident snapshots. A technical report detailing the incident is also forthcoming, which will provide further insights into the exploit and the measures being taken to prevent future occurrences.

• Investors in SAND tokens: Immediate price pressure and trading restrictions on affected exchanges.
• Liquidity providers: Potential compensation based on pre-incident snapshots, but uncertainty remains.
• Web3 developers: Increased scrutiny on cross-chain protocols may lead to more stringent security measures.

• Technical report release: The details will clarify the exploit's mechanics and inform future security protocols.
• Market reactions: Watch for SAND price movements and trading volume on exchanges as the situation evolves.
• Regulatory responses: Increased scrutiny on cross-chain protocols could lead to new compliance requirements.