The Sandbox shut down its cross-chain bridge on Base and BNB Smart Chain on Aug. 22 after an attacker exploited a vulnerability in the SAND bridge contracts, minting unbacked tokens on both networks. The project said it had fully contained the vulnerability and that no user wallets were compromised.
Blockchain forensics firm BlockWatchdog traced the realized economic damage to about 14.75 million SAND withdrawn from the Ethereum adapter in under one minute. The attacker sold those tokens for approximately 80 ETH, valued at roughly $675,000 at the time of the transactions.
The gap between $675,000 in realized losses and the enormous minted supply explains The Sandbox's claim that direct impact fell below 0.01 percent of the 3 billion total SAND supply. SAND minted on Base or BNB Smart Chain carries no claim on the Ethereum-locked collateral unless it can be redeemed through the official bridge—which the team disabled before the attacker could execute a larger redemption.
Security firm Blockaid attributed the exploit to a takeover of LayerZero delegate permissions through an approveAndCall function. That access let the attacker interact with the cross-chain contracts and issue tokens on the affected networks. The Sandbox has not confirmed Blockaid's proposed root cause in a detailed postmortem, and no full technical report has been published reconciling the project's loss estimate with independent on-chain figures.
LayerZero's Omnichain Fungible Token standard underpins the bridge. Under its adapter model, a token is locked on the source chain—in this case Ethereum—and a corresponding representation is minted on the destination chain. The exploit broke that 1:1 relationship by allowing minting on Base and BNB Smart Chain without corresponding collateral being locked on Ethereum, producing counterfeit tokens stranded on the affected networks.
Early on-chain alerts flagged more than 500 million SAND minted on Base before the figure climbed rapidly as the attacker continued interacting with the contract. PeckShield later identified roughly 14.9 billion SAND created across two addresses. The divergence between those figures and the 14.75 million SAND actually pulled from the Ethereum adapter illustrates the core mechanics: the majority of minted tokens were stranded on Base and BNB Smart Chain with no real backing and no redemption path.
The Sandbox said all SAND bridged before the incident remains backed by SAND locked on Ethereum, and that holdings on Ethereum and Polygon were unaffected. The team is taking a pre-attack snapshot and said eligible liquidity providers on the affected chains will receive compensation. No payment schedule has been announced.
While the bridge remained disabled, the project told users not to buy, sell, or add liquidity for SAND on Base or BNB Smart Chain. The isolated tokens on those networks cannot be redeemed through the official bridge, and the project has not announced a plan to restore bridging to either chain.
Upbit and Bithumb froze SAND deposits and withdrawals following the incident. Coinbase, which listed SAND perpetual futures, announced it plans to delist those futures on Aug. 26.
The LayerZero bridge attack on The Sandbox is the latest in a series of cross-chain bridge exploits that have collectively cost DeFi hundreds of millions of dollars over the past three years. Bridge infrastructure remains one of the highest-risk surfaces in on-chain systems: the adapter model requires trust in permissioned delegate roles, and a single compromised access key can give an attacker the ability to mint across multiple destination chains simultaneously. The Sandbox's containment was fast enough to cap realized losses well below what the minted supply numbers suggested, but the full postmortem—specifically how delegate permissions were taken over and why the approveAndCall function was exposed—remains unpublished.
