The Sandbox Exploit: Separating Fact from Fiction

The Sandbox's cross-chain bridge was exploited on August 22, 2026, resulting in nearly $49 billion in newly minted SAND appearing on blockchain trackers. However, this figure was an inflated estimate, as it did not account for the lack of backing or collateral behind these tokens.

According to Blockaid, the attacker hijacked LayerZero delegate permissions tied to The Sandbox's Omnichain Fungible Token (OFT) on Base through an approveAndCall route. This allowed them to mint SAND without normal backing on Ethereum.

The attack severed the relationship between tokens created on one network and those locked or burned on another, allowing new SAND to appear on affected networks without a matching reduction or reserve arrangement on Ethereum.

Independent on-chain tracking indicates that around $675,000 in legitimate SAND left reserves before the bridge was halted. This figure is much smaller than the inflated estimate of nearly $49 billion.