Sandbox Halts Base and BNB Chain Bridging After Token Exploit

Web3 gaming platform The Sandbox disabled token bridging on Base and BNB Smart Chain after discovering an exploit that allowed an attacker to mint unbacked SAND tokens on those networks.

How the Exploit Unfolded

According to blockchain security firm Blockaid, the attacker hijacked LayerZero delegate permissions using an “approveAndCall” function to create unbacked tokens across more than 400 transactions. The nominal face value of the minted tokens reached roughly $49 billion, though this figure reflects token creation at market price rather than actual funds stolen or accessible to the attacker. SAND’s real market capitalization stands at approximately $136 million. Separately, PeckShield identified 14.9 billion SAND minted across two wallet addresses, with different firms reporting figures at different stages of the incident.

Limited Scope, According to Sandbox

The Sandbox said the exploit affected less than 0.01% of SAND’s 3 billion token supply, equivalent to fewer than 300,000 tokens. The company confirmed no user wallets were compromised and that SAND on Ethereum and Polygon remains unaffected, along with the tokens locked on Ethereum backing the bridge.

Response and Next Steps

Bridging to and from Base and BNB Smart Chain has been disabled, and Sandbox warned users against trading SAND on those networks due to compromised liquidity. South Korean exchanges Bithumb and Upbit also suspended SAND deposits and withdrawals as a precaution. Sandbox said it is preparing a pre-incident snapshot to determine compensation for affected liquidity pool users and plans to release a full technical post-mortem. SAND fell nearly 10% intraday following the news but was down just 0.8% over 24 hours.