The Sandbox has fully contained a vulnerability affecting its SAND cross-chain bridge on both Base and BNB Smart Chain. An attacker exploited a smart contract flaw to mint unbacked SAND tokens on both networks before the team disabled bridging functions, preventing further unauthorized token generation.
The incident impacted less than 0.01 percent of SAND's total supply. Assets on Ethereum and Polygon, user wallets, and Ethereum-locked backing assets remain unaffected. The core assets backing the SAND ecosystem were not compromised.
Cross-chain bridges have emerged as persistent weak points in blockchain infrastructure. Over $2.8 billion has been lost to bridge exploits in recent years. The March 2022 Ronin Bridge hack saw attackers gain control of 5 of 9 validator keys and steal 173,600 ETH and 25.5 million USDC. Harmony's Horizon Bridge lost over $100 million after 2 of 5 keys were compromised. The Nomad Bridge hack in August 2022 cost $190 million when the contract accepted a zero Merkle root as valid, allowing attackers to craft fraudulent messages.
The Sandbox team is preparing a compensation plan for eligible liquidity providers directly impacted by the exploit on the Base and BNB Smart Chain bridges. Details on eligibility and distribution are forthcoming.
Users received an advisory against trading SAND on Base or BNB Smart Chain networks to prevent acquisition of potentially unbacked tokens on these chains. Trading on Ethereum and Polygon remains unaffected.
