Key Takeaways
- Attackers minted 500M+ unbacked SAND, triggering emergency bridge shutdowns.
- Korean exchanges suspended transfers and warned users about extreme volatility.
- Ethereum and Polygon SAND remained unaffected by the bridge exploit.
The Sandbox has contained a cross-chain bridge exploit that allowed an attacker to mint hundreds of millions of unbacked SAND tokens on Base, prompting South Korea’s largest crypto exchanges to freeze transfers and warn traders about potential volatility.
Early onchain alerts on Aug. 22 showed more than 500 million SAND created without corresponding collateral.
That amount alone was equivalent to roughly 16.7% of SAND’s fixed 3 billion maximum supply, although the tokens were created on the affected cross-chain deployment rather than added to Ethereum’s native SAND supply.
The Sandbox later confirmed that its bridge infrastructure on Base and BNB Smart Chain (BSC) had been compromised.
It disabled bridging on both networks and said SAND on Ethereum and Polygon, user wallets, and the Ethereum reserves backing legitimate bridged SAND remained unaffected.
Security Firms Counted Billions of Unbacked SAND
The initial 500 million figure quickly grew as security researchers tracked the attacker.
PeckShield subsequently reported approximately 14.9 billion SAND minted across two addresses, nearly five times SAND’s official maximum supply.
Blockaid produced an even larger nominal estimate, saying roughly $49 billion in face-value SAND had been minted across more than 400 transactions.
However, those numbers should not be interpreted as a $49 billion theft.
The newly created tokens lacked the Ethereum SAND required to back them through the bridge. Once The Sandbox disabled cross-chain transfers, the affected Base and BSC tokens became isolated and could no longer be redeemed through the official bridge.
The Sandbox put the actual impact at less than 0.01% of the total SAND supply and is preparing compensation for eligible liquidity providers affected before the bridge was shut down. A detailed technical post-mortem is still pending.
Blockaid attributed the exploit to attackers hijacking LayerZero delegate permissions via approveAndCall, enabling unauthorized minting of the SAND omnichain token deployment. The Sandbox has not yet published its own full technical explanation of how those permissions were compromised.
Upbit and Bithumb Halt SAND Transfers
Korean exchanges reacted within hours.
Bithumb suspended SAND deposits and withdrawals at 11:11 a.m. KST on Aug. 22, citing suspected security problems. Its notice said trading would remain available. However, customers were specifically warned that sharp price fluctuations could occur during the transfer suspension.
Upbit also suspended SAND deposits and withdrawals and issued a separate trading caution, drawing unusually broad attention to the incident across South Korea’s major exchanges.
The market reacted with heavy turnover.
SAND fell 7.99% on Aug. 22, closing around $0.0451 after trading as high as $0.0521. Daily volume jumped to approximately $217 million, compared with $71.5 million the previous day. The token was down another roughly 3% on Aug. 23 at about $0.0436.
Bridge Isolation Limited the Wider Damage
The episode centers on The Sandbox’s cross-chain infrastructure rather than its core Ethereum token contract.
Legitimate bridged SAND relies on tokens locked on Ethereum to support representations issued on other networks. The exploit instead allowed unbacked representations to be created on Base and BSC.
The Sandbox has told users not to buy, sell or provide liquidity for SAND on either affected network while the deployments remain isolated. Ethereum and Polygon holders will take no action.
The huge mint figures show how extensively the attacker was able to create unbacked SAND, but they should not be read as the amount successfully stolen or cashed out.
The Sandbox said the actual impact was below 0.01% of the total SAND supply, while the final realized loss remains unclear. A clearer figure is expected in the project’s promised technical post-mortem.
Top Trending Crypto Articles
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Giuseppe Ciccomascolo began his career as an investigative journalist in Italy, where he contributed to both local and national newspapers, focusing on various financial sectors.
Upon relocating to London, he worked as an analyst for Fitch's CapitalStructure and later as a Senior Reporter for Alliance News. In 2017, Giuseppe transitioned to covering cryptocurrency-related news, producing documentaries and articles on Bitcoin and other emerging digital currencies. He also played a pivotal role in establishing the academy for a cryptocurrency exchange website. Crypto remained his primary area of interest throughout his tenure as a writer for ThirdFloor.
