Sandbox Bridge Exploit: Trillions of SAND Minted, $675K Stolen

An attacker exploited a bridge configuration flaw on Base and BNB Smart Chain, hijacking LayerZero delegate permissions and minting 329.24 trillion unbacked SAND tokens across 703 events over five hours on August 21 and 22, 2026.

The face value of the minted tokens reached approximately $49 billion, but the actual extraction totaled roughly $675,000 in 14.75 million SAND drained from the Ethereum OFT Adapter in under 60 seconds.

The attacker could never have cashed out more than a fraction of what was created due to structural constraints and liquidity issues.

The Sandbox team disabled bridging on Base and BNB Smart Chain, removed LayerZero peer settings via multisig governance, and confirmed that SAND on Ethereum and Polygon remained untouched throughout the incident.