Crypto
SAND Bridge Drained Via Legacy Token Function, The Sandbox Post-Mortem Finds
The Sandbox suffered a bridge misconfiguration on Base and BNB Smart Chain, allowing an attacker to drain 14,742,341.84 SAND, worth roughly $697,000 or about 0.5% of max supply.
A legacy approveAndCall function was exploited by the attacker, handing them LayerZero delegate rights, which enabled unbacked minting without any corresponding deposit on Ethereum.
The official claim process for affected holders will go live next week, with eligibility rules, a timeline and step-by-step instructions to follow on X and The Sandbox blog.