Polygon (Old)

Base

The Sandbox

LayerZero

<h3 id="key-takeaways">Key Takeaways</h3>
<ul>
 <li>A malicious actor compromised The Sandbox’s Base network smart contract, fabricating approximately 14.9 billion SAND tokens without proper backing</li>
 <li>Real financial damage amounted to approximately 14.75 million SAND extracted from Ethereum, yielding the hacker roughly $675,000 (80 ETH)</li>
 <li>The project immediately disabled cross-chain bridges on Base and BNB Smart Chain networks</li>
 <li>Major Korean cryptocurrency platforms Upbit and Bithumb paused SAND trading activities</li>
 <li>Tokens on Ethereum and Polygon networks remained secure, with no individual user wallets breached</li>
</ul>
On August 22, 2026, a security breach granted an unauthorized party unrestricted minting capabilities on The Sandbox’s SAND smart contract operating on Base, which utilizes Layer Zero’s Omnichain Fungible Token framework for multi-chain token transfers.
<div class="embed-x">
 <blockquote class="twitter-tweet">
 <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/26a0.png" alt="⚠" style="height: 1em; max-height: 1em;">ALERT: Sandbox hit by a major security breach as attackers mint 49B of unbacked <a href="https://x.com/search?q=%24SAND&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$SAND</a>, compromising its ENTIRE liquidity across BSC and Base.
 The team has confirmed the exploit and isolated SAND liquidity on BSC and Base, while disabling bridging to and from both networks.… <a href="https://t.co/UdvHTm7wuu" rel="noopener noreferrer nofollow">pic.twitter.com/UdvHTm7wuu</a>
 — Coin Bureau (@coinbureau) <a href="https://x.com/coinbureau/status/2091096287483756752?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">August 22, 2026</a>
 </blockquote>
</div>
By exploiting an “approveAndCall” mechanism, the perpetrator commandeered LayerZero delegate authorization. This security flaw enabled unauthorized token creation on Base without corresponding collateral from legitimate SAND reserves locked on <a href="https://coincentral.com/ethereum-eth-casinos/" rel="noopener noreferrer nofollow">Ethereum</a>.
Cybersecurity firm Blockaid detected the ongoing exploit in real-time. PeckShield independently verified that approximately 14.9 billion SAND tokens were fraudulently generated across two wallet addresses—a figure dramatically surpassing the token’s legitimate 3 billion supply on Ethereum’s main network.
<div class="embed-x">
 <blockquote class="twitter-tweet">
 <a href="https://x.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#PeckShieldAlert</a> Seems like The <a href="https://x.com/TheSandboxGame?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@TheSandboxGame</a> (<a href="https://x.com/search?q=%24SAND&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$SAND</a>) got exploited. 14.9B <a href="https://x.com/search?q=%24SAND&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$SAND</a> minted across 2 addresses: 0xAbE0…4D22 &amp; 0x638C…F296 <a href="https://t.co/a5Jgym87gR" rel="noopener noreferrer nofollow">pic.twitter.com/a5Jgym87gR</a>
 — PeckShield <a href="https://x.com/PeckShieldAlert/status/2091037704314339331?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">August 22, 2026</a>
 </blockquote>
</div>
The widely circulated $49 billion figure stems from calculating SAND’s market value against the illegitimate token count. This number doesn’t reflect actual stolen assets. It substantially exceeds available market liquidity and couldn’t be converted to cash.
The genuine financial impact was considerably smaller. BlockWatchdog documented that roughly 14.75 million SAND was extracted from the Ethereum OFT Adapter within 60 seconds, generating approximately 80 ETH in proceeds, equivalent to about $675,000.
According to The Sandbox’s official statement, the security breach impacted under 0.01% of SAND’s total 3 billion token circulation when calculated directly.
<h3 id="the-sandbox-s-crisis-response">The Sandbox’s Crisis Response</h3>
The development team immediately deactivated bridging functionality to and from Base and BNB Smart Chain, rendering tokens on these networks immobile and non-redeemable. The project’s multi-signature wallet also eliminated the LayerZero peers for Ethereum and BNB Smart Chain, successfully quarantining Base.
Users received urgent warnings against purchasing, selling, or exchanging SAND on Base or BNB networks due to tainted liquidity. SAND holdings on <a href="https://coincentral.com/ethereum-eth-price-eth-surges-above-2500-as-short-squeeze-and-etf-inflows-drive-rally/" rel="noopener noreferrer nofollow">Ethereum</a> and Polygon were verified as uncompromised. The SAND reserves locked on Ethereum backing cross-chain operations remained fully secured.
South Korean trading platforms responded swiftly. Upbit published a trading advisory while Bithumb halted SAND deposit and withdrawal services following blockchain monitoring alerts about the vulnerability.
The Sandbox, operating under Animoca Brands and having secured $93 million in funding during 2021, announced plans to capture a pre-incident snapshot and develop compensation measures for affected liquidity pool participants.
A comprehensive technical analysis is forthcoming. As of publication, the development team hasn’t released a complete public explanation regarding the vulnerability’s origin.
SAND experienced a nearly 10% price decline during trading hours immediately following the breach but recovered to show only a 0.8% decrease across the full 24-hour cycle.
<figure style="width: 100%" class="wp-caption aligncenter"><img src="https://blockonomi.com/wp-content/uploads/2026/08/chart-41.webp" alt="The Sandbox (SAND) Price" width="1824" height="1248">
 <figcaption><a href="https://www.coingecko.com/en/coins/the-sandbox?chart=type%3Dprice%26mode%3Dline%26timeframe%3Dd7" rel="noopener noreferrer nofollow">The Sandbox (SAND) Price</a>
 </figcaption>
</figure>
This security incident underscores an established systemic vulnerability in multi-chain token architecture. Creating tokens on auxiliary chains doesn’t generate additional Ethereum supply, yet these unsupported tokens can still reach trading platforms and create downward price momentum.
Investors should closely track announcements from Upbit and Bithumb regarding trading restoration timelines and await The Sandbox’s formal recovery strategy or token burn proposal.
The post <a href="https://blockonomi.com/the-sandbox-sand-bridge-exploit-attacker-mints-14-9b-unbacked-tokens-on-base-network/" rel="noopener noreferrer nofollow">The Sandbox (SAND) Bridge Exploit: Attacker Mints 14.9B Unbacked Tokens on Base Network</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

The Sandbox (SAND) Bridge Exploit: Attacker Mints 14.9B Unbacked Tokens on Base Network

Table of Contents

Blockonomi

Other articles published on Aug 23, 2026

Join our free newsletter for daily crypto updates!