The Sandbox's $49B Token Flood Exposes Base Network Vulnerability

The Sandbox's SAND token has been exploited in a massive security breach on the Base network. According to onchain data, nearly $49 billion worth of SAND has been created through over 400 transactions.

The attack is linked to the project's cross-chain OFT contract on Base, which was reportedly exploited by an attacker using 'approveAndCall' to bypass normal controls and create new SAND without backing. This resulted in around 14.9 billion SAND appearing across two addresses linked to the attack.

Blockaid detected the exploit and reported that nearly $49 billion face-value SAND had been minted so far, but stressed that this figure represents market value, not actual stolen funds. The attackers likely cannot sell such a large amount of tokens without crashing the price of SAND.

The Ethereum OFT adapter reportedly lost around 14.75 million SAND, worth about $675,000 at the time, while around 79.74 ETH was converted from the stolen funds. Exchanges Bithumb and Upbit have taken action, suspending SAND deposits and withdrawals on Base, respectively.

The Sandbox team has confirmed that it has fixed the security issue affecting SAND's cross-chain bridge on Base and BNB Smart Chain (BSC), but warned users not to buy, sell, or trade SAND on these networks. The team is taking a snapshot of the network before the attack and plans to compensate eligible liquidity providers.