Sandbox Cross-Chain Bridge Exploit Leaves Billions at Risk

A major security breach in The Sandbox's cross-chain bridge has left billions of dollars' worth of SAND tokens at risk.

The vulnerability, which affected deployments on Base and BNB Smart Chain, allowed an attacker to mint unbacked SAND tokens out of thin air. According to Blockaid, the attacker obtained unauthorized access to LayerZero delegate permissions via an approveAndCall function present in SAND's cross-chain fungible token contract deployed on Base.

The breach was discovered early on August 22, and The Sandbox promptly shut it down, claiming that no user wallets were compromised. However, security firms disagree with the project's assessment of the damage, with Blockaid estimating $49 billion in minted fake SAND across over 400 transactions.

South Korean exchanges Upbit and Bithumb froze SAND deposits and withdrawals, citing the country's Virtual Asset User Protection Act. The Sandbox has promised a compensation scheme for affected users but has yet to release a technical report reconciling its own estimate with outside researchers' numbers.