The Sandbox Contains Bridge Exploit After Unbacked SAND Minted on Base and BSC

The Sandbox said it has contained a vulnerability in the SAND cross-chain bridge on Base and BNB Smart Chain after an attacker minted unbacked tokens on both networks.

The project put the impact at under 0.01% of the total SAND supply. It said that tokens on Ethereum (ETH) and Polygon (POL) are unaffected and that no user wallets were compromised.

Sandbox Becomes Latest Project Reportedly Hit by an Exploit

Blockaid flagged the incident on Saturday. The firm said attackers hijacked LayerZero delegate permissions through the approveAndCall function. 

“~$49B face-value SAND minted so far across ~400+ txs,” Blockaid said.

Follow us on X to get the latest news as it happens

#PeckShieldAlert Seems like The @TheSandboxGame ($SAND) got exploited. 14.9B $SAND minted across 2 addresses: 0xAbE0…4D22 & 0x638C…F296 pic.twitter.com/a5Jgym87gR

— PeckShieldAlert (@PeckShieldAlert) August 22, 2026

The team said that it has disabled bridging to and from Base and BSC, cutting off any route to move or redeem the minted supply. It said the SAND locked on Ethereum, which backs all bridged tokens, remains intact.

“An attacker was able to mint unbacked SAND on Base and BSC. We have disabled bridging to and from both networks, so SAND on Base and BSC is currently isolated and cannot be moved or redeemed,” the post read.

The project told holders not to buy, sell, or trade SAND on either network, warning that liquidity there is compromised. It is taking a pre-incident snapshot and preparing compensation for qualifying liquidity providers, with a full post-mortem promised.

Korean Exchanges Halt SAND Transfers 

Meanwhile, Bithumb suspended SAND deposits and withdrawals at 11:11 a.m. KST, and Upbit followed one minute later. Both cited suspected security incidents under South Korea’s Virtual Asset User Protection Act.

Upbit imposed a halt on the Ethereum version of SAND, which the project has since said was never at risk.

The incident fits a wider pattern. DefiLlama has logged 17 separate exploits so far this month, most of them small, with bridges again the recurring weak point.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights