14.9 billion SAND tokens minted after Sandbox exploit: Report

Web3 gaming project The Sandbox suffered a cross-chain bridge exploit affecting SAND on Base and BNB Smart Chain.

According to security firm PeckShield, the attacker minted 14.9 billion unbacked SAND across two wallet addresses. That translates to about $718M. 

Another blockchain security firm, Blockaid, clarified that the issue involved The Sandbox’s SAND Omnichain Fungible Token on Base. The OFT is a LayerZero feature that allows projects to seamlessly move tokens across blockchains.

In this particular case, the attacker compromised the Base OFT and gained administrative permissions for minting SAND. Blockaid denied the blame leveled against LayerZero, maintaining that the issue was with the Base SAND minting system.

Sandbox team downplays the hack

In a statement, the project team said that it has identified and “contained” the vulnerability. It downplayed the minted tokens and impact, adding that 

The impact is minimal, representing less than 0.01% of the total SAND token supply. SAND tokens on Ethereum and Polygon are NOT affected. No user wallets were compromised, and no action is required from holders and liquidity pool (LP) providers on those networks.

However, the team cautioned users against dealing with the SAND token across the Base or BSC chains. As part of the mitigation efforts, the project said it disabled movement and redemption of SAND between Base/BSC and other networks.