Sandbox Contains Exploit After Attacker Mints 14.9B SAND Tokens

The Sandbox said it contained a bridge exploit after an attacker reportedly minted 14.9 billion unbacked SAND (SAND) tokens on Base and BNB Smart Chain.

Key Points:

• PeckShield reported 14.9 billion unbacked SAND minted across two wallets, with a nominal value of about $718 million.
• The Sandbox said the vulnerability was limited to Base and BNB Smart Chain, while Ethereum and Polygon were unaffected.
• No user wallets were compromised, the project said.

Sandbox Bridge Exploit

Security firm PeckShield said the attacker created 14.9 billion unbacked SAND across two addresses, valuing the unauthorized tokens at roughly $718 million. Blockaid said the incident involved The Sandbox’s Omnichain Fungible Token on Base, a cross-chain token standard using LayerZero infrastructure.

Blockaid said the attacker compromised the Base OFT and obtained administrative permissions that allowed new SAND to be minted. LayerZero itself was not compromised, Blockaid said.

The Sandbox said it identified and contained the vulnerability, adding, “The impact is minimal, representing less than 0.01% of the total SAND token supply.” Ethereum and Polygon SAND were unaffected, it said.

The project warned users against trading SAND on Base or BNB Smart Chain while affected liquidity remained isolated. Transfers and redemptions were disabled, and eligible liquidity providers will be compensated after review.