On August 22, 2026, attackers exploited LayerZero delegate permissions in The Sandbox's SAND cross-chain bridge on Base and BNB Smart Chain, minting approximately 500 million unbacked tokens and stealing 14.75 million SAND tokens worth around $675,000 from the Ethereum OFT adapter. The Sandbox halted bridging on both affected networks and plans to compensate eligible liquidity providers using a pre-attack snapshot.
Bridge exploit mechanics
- ▪Attackers gained control of LayerZero delegate permissions linked to The Sandbox's SAND OFT system on Base network
- ▪Attackers used approveAndCall to bypass normal controls and create new SAND tokens without required backing on The Sandbox's Base network bridge
- ▪The Sandbox's SAND cross-chain OFT contract on the Base network was exploited in an infinite mint attack on August 22, 2026
- ▪The Sandbox bridge exploit also affected BNB Smart Chain in addition to Base network
Stolen token valuation
- ▪The Ethereum OFT adapter lost around 14.75 million SAND tokens worth approximately $675,000 in The Sandbox bridge exploit
- ▪Around 79.74 ETH was converted from the stolen SAND tokens in The Sandbox bridge exploit
- ▪Nearly $49 billion worth of SAND tokens were created through more than 400 transactions in The Sandbox bridge exploit
- ▪The impact of The Sandbox bridge exploit represents less than 0.01% of the total SAND token supply
Exchange response
- ▪Bithumb suspended SAND deposits and withdrawals following The Sandbox bridge exploit on August 22, 2026
- ▪CertiK flagged The Sandbox bridge exploit incident on August 22, 2026
- ▪Upbit issued an investor warning over abnormal on-chain activity related to The Sandbox bridge exploit
Sandbox containment measures
- ▪The Sandbox is taking a snapshot of the network before the August 22, 2026 attack and plans to compensate eligible liquidity providers
- ▪The Sandbox asked users not to buy, sell, or trade SAND on Base or BSC networks following the August 22, 2026 exploit
- ▪SAND tokens locked on Ethereum remain safe following The Sandbox bridge exploit on August 22, 2026
- ▪The Sandbox is a metaverse project
- ▪No user wallets were hacked in The Sandbox bridge exploit on August 22, 2026
- ▪SAND tokens on Ethereum and Polygon were not affected by The Sandbox bridge exploit on August 22, 2026
- ▪The Sandbox stopped bridging on Base and BNB Smart Chain networks following the August 22, 2026 exploit
SAND price reaction
- ▪SAND has a total supply of 3 billion tokens
- ▪SAND token price was up 4.76% at $0.0476 on August 22, 2026 despite reports of The Sandbox bridge exploit
- ▪SAND trading volume jumped more than 400% on August 22, 2026 during The Sandbox bridge exploit
Perspective of Cryptocurrency exchanges (Bithumb and Upbit)
- ▪Upbit issued an investor warning over abnormal on-chain activity related to The Sandbox bridge exploit
- ▪Bithumb suspended SAND deposits and withdrawals following The Sandbox bridge exploit on August 22, 2026
Story comments
Loading comments…