The Sandbox Bridge Exploited, $49 Billion Face-Value of SAND Minted

The Sandbox's cross-chain bridge was exploited by an attacker who minted unbacked SAND tokens on Base and BNB Smart Chain, resulting in approximately $49 billion face-value of tokens being minted across ~400 transactions.

Blockaid flagged the incident on Saturday, highlighting the vulnerability in the LayerZero delegate permissions through the approveAndCall function. The team quickly responded by disabling bridging to and from both networks, isolating SAND on Base and BSC, which cannot be moved or redeemed.

The project assured holders that Ethereum and Polygon balances are intact and that no user wallets were compromised. However, it warned users not to buy, sell, or trade SAND on either network due to compromised liquidity.

Korean exchanges Bithumb and Upbit halted SAND deposits and withdrawals, while the team is preparing compensation for affected liquidity providers. The incident serves as a reminder of recurring bridge security risks in crypto and DeFi, with DefiLlama logging 17 separate exploits so far this month.