Sandbox's Token Supply Compromised in Five-Hour Attack

The Sandbox's (SAND) token supply was compromised when an attacker hijacked delegate permissions on the SAND Omnichand Fungible Token contract on Base, minting over 329 trillion tokens in a five-hour rampage.

The attack began at 23:42:05 UTC on August 21 and ended at 04:45:21 UTC on August 22. The attacker exploited the LayerZero OFT peer manipulation vulnerability to gain admin rights to the Base SAND OFT contract, allowing them to mint unbacked tokens without burning them on Ethereum.

The face value of the newly minted SAND is approximately $49 billion, but the actual extractable loss sits at around $665,000 in drained Ethereum-side reserves. This discrepancy highlights how OFT exploits can appear catastrophic on paper while remaining structurally contained.