Sandbox SAND Token Slammed by Cross-Chain Exploit Worth Billions

The Sandbox's SAND token was hit by a major cross-chain exploit on August 22, 2026. An attacker gained arbitrary minting rights to the SAND contract deployed on Base, allowing them to create an astonishing 14.9 billion unbacked tokens. This figure far exceeds the total supply of SAND on Ethereum mainnet.

The actual loss was much smaller than the headline figure, with around $675,000 (80 ETH) drained from the Ethereum OFT Adapter in under a minute. The attacker used an 'approveAndCall' function to hijack LayerZero delegate permissions and mint tokens on Base without any backing from the real, locked SAND held on Ethereum.

The Sandbox team quickly responded by halting bridging on Base and BNB Smart Chain to contain the damage. South Korean exchanges Upbit and Bithumb suspended SAND deposits and withdrawals after on-chain alerts flagged the breach.