Sandbox Exploit Mints Unbacked Tokens Worth $49 Billion

The Sandbox has contained an exploit in its SAND cross-chain bridge that allowed attackers to mint unbacked tokens on Base and BNB Smart Chain.

The studio behind the virtual-world game said it identified and fully contained the vulnerability, which it described as 'less than 0.01% of total SAND supply.' The attack, however, is estimated to have resulted in around $49 billion worth of minted tokens across more than 400 transactions.

The exploit occurred through a function called `approveAndCall` on SAND's omnichain fungible token contract on Base, according to security firm Blockaid. This allowed attackers to hijack LayerZero delegate permissions and mint new units on the given chain.

The affected liquidity pools have been frozen by exchanges Upbit and Bithumb in South Korea, with both halting SAND transfers and warning of potential price volatility. The Sandbox has promised a compensation plan for qualified users and a full incident report.