Phantom Mint: $49 Billion Worth of Unbacked SAND Tokens Mined in The Sandbox Hack
The Sandbox's $49 billion phantom mint was an attack on its SAND token contract, which allowed an attacker to hijack LayerZero delegate permissions and mint 329 trillion unbacked tokens. The actual financial extraction was far smaller: roughly 14.75 million SAND drained from the Ethereum OFT Adapter in under 60 seconds, yielding approximately $675,000.
The attack occurred on August 21-22, 2026, when an attacker exploited a vulnerability in the approveAndCall function of The Sandbox's SAND omnichain fungible token contract on Base. This allowed them to mint tokens without any corresponding lock of tokens on the Ethereum side.
Blockchain security firm Blockaid flagged $49 billion in face-value SAND minted across more than 400 transactions, while PeckShield counted 14.9 billion SAND directed to two attacker-controlled addresses.