Sandbox Bridge Exploit Nets $987k in Stolen Funds

The Sandbox has disclosed a bridge exploit that occurred on August 21, 2026, resulting in an estimated economic damage of approximately $1.5 million, with around $987,000 ending up in the attacker's hands.

The attack unfolded through four decisive steps that exploited a token contract capability on Base and BNB Smart Chain, allowing the attacker to register an address with administrator rights and rewrite the verification process.

The attacker then sold unbacked SAND for genuine ETH, coaxing the bridge into releasing holdings from the Ethereum vault. The precision of the attack was striking, as the mint came exactly 100 tokens below what the vault held at that moment.