Sandbox Network Security Breach
The Sandbox Disables Bridging After Unauthorized SAND Minting Incident on Base and BSC
Key Points
Attackers hijacked LayerZero delegate permissions via the approveAndCall function, enabling unauthorized minting of SAND on Base and BNB Smart Chain. Blockaid flagged the incident and the Sandbox said bridging to and from Base and BSC has been disabled to contain the breach.
minted totals around the incident are inconsistent across outlets: The Sandbox says the impact is under 0.01% of total supply (about 500 million on affected networks), while other reports describe much larger figures — Lookonchain references more than 500 million, and PeckShield/others have cited numbers such as 14.9 billion minted across addresses on Base.
Upbit expanded its response to include halting the Ethereum version of SAND in addition to suspending deposits/withdrawals on the Base and BSC networks; Bithumb also suspended deposits and withdrawals as a precaution.
The breach appears to be isolated to the Base and BNB Smart Chain deployments; the Ethereum-backed SAND on Ethereum and the Polygon chain reportedly remain unaffected, with the SAND on Ethereum-backed bridged tokens remaining intact and isolated bridging disabled.
Sandbox says it is taking a pre-incident snapshot and preparing compensation for qualifying liquidity providers on affected networks as part of its post-incident plan.
The Sandbox discovered a critical exploit that allowed attackers to mint over 500 million unbacked SAND tokens on Base and BNB Smart Chain, roughly 17% of total supply Yahoo Finance. The attackers hijacked LayerZero delegate permissions through the approveAndCall function, triggering an "infinite mint" vulnerability that could dilute existing holders and damage trust in the token Blockaid.
The Sandbox has disabled bridging to and from both affected networks and is preparing a snapshot and compensation plan for impacted liquidity providers Yahoo Finance. Major exchanges including Upbit and Bithumb have suspended SAND deposits and withdrawals on affected chains, with Upbit warning traders to brace for volatility as investigations continue BeInCrypto.
Attackers Exploit LayerZero Bridge Vulnerability
The exploit centered on SAND's cross-chain OFT contract on Base and BSC Hoka News. Attackers used the approveAndCall function to seize delegate permissions, enabling them to mint unlimited unbacked tokens without collateral Head Topics. The Sandbox moved quickly to contain the breach by disabling all bridging between the affected networks and the broader ecosystem.
Conflicting Reports on Total Tokens Minted
Numbers vary sharply across security analysts and reports. The Sandbox claims the impact is under 0.01% of total supply — about 500 million tokens Yahoo Finance. But other researchers paint a much grimmer picture: Lookonchain cited over 500 million minted, while PeckShield and other analysts reported 14.9 billion fraudulent SAND created across addresses on Base Head Topics. Some outlets valued the minted tokens at nearly $49 billion Tron Weekly.
Ethereum and Polygon SAND Remain Unaffected
The exploit appears isolated to cross-chain deployments. SAND on Ethereum and Polygon remain intact and secure Yahoo Finance. The core Ethereum-backed token avoided compromise because The Sandbox had already disabled bridging to and from Base and BSC. This containment strategy prevented attackers from flowing fraudulent tokens to other chains BeInCrypto.
Exchanges Suspend SAND Trading Amid Security Concerns
Upbit halted deposits and withdrawals for SAND on Base, BSC, and Ethereum as a precautionary measure BeInCrypto. Bithumb followed suit, suspending all SAND deposit and withdrawal activity on compromised networks Hoka News. Both exchanges cited security concerns and the need to protect customer assets during the active investigation and remediation effort.
Sandbox Commits to Liquidity Provider Compensation
The Sandbox announced it will take a pre-incident snapshot and create a compensation plan for qualifying liquidity providers on affected networks Yahoo Finance. This move aims to restore confidence in the ecosystem after the trust-eroding breach. The project is now racing to fully understand the exploit's scope, patch the vulnerability, and rebuild market confidence as investors await more details on recovery timelines and final damage assessments BeInCrypto.
Sentiment
Mostly NegativePublishers
12
Articles
6
Reach
18
