SANDbridge: Billion-Dollar Bridge Exploit Rocks The Sandbox
The Sandbox's cross-chain bridge was exploited by an attacker, creating billions of unbacked SAND tokens on Base and BNB Smart Chain.
Security researchers estimated that the attacker minted around $49 billion worth of SAND, but this figure is misleading. The SAND market capitalization at the time was only around $140 million, so there was no real value to be stolen.
The attack targeted the LayerZero delegate permissions tied to SAND's omnichain fungible token contract, allowing the attacker to mint tokens without corresponding collateral. Blockaid flagged over 400 transactions with a total face value of around $49 billion, while PeckShield counted 14.9 billion SAND minted across two attacker addresses.
The total amount of unauthorized tokens is nearly five times the maximum supply of 3 billion tokens that SAND was ever supposed to have. The affected bridge routes have been disabled by The Sandbox, and the company has warned users not to trade or redeem affected tokens.