Sandbox Token Exploited for Billions as Malicious Actor Compromises Cross-Chain Bridge

The Sandbox has suspended all cross-chain transfers and frozen the SAND token's functionality on Base and BNB Smart Chain after a malicious actor exploited a vulnerability in its SAND cross-chain bridge.

The attacker used LayerZero's Omnichain Fungible Token (OFT) standard to mint 14.9 billion unbacked SAND tokens by compromising bridge delegate permissions through the approveAndCall function.

Although a staggering $49 billion face-value estimate of SAND was minted, only around 14.75 million SAND were actually transferred to usable wallets, which is less than 0.01% of the total supply.

The affected tokens on Base and BSC are now isolated, non-transferable, and non-redeemable against Ethereum-backed reserves. The Sandbox has warned users not to trade these tokens, as they carry zero backing and will likely never be honored.