Key Takeaways
- Peckshield flagged roughly 14.9 billion unbacked SAND minted throughout two addresses on August 21.
- The Sandbox disabled Base and BSC bridging subsequently, shielding Ethereum and Polygon-based SAND holders.
- The Sandbox is getting ready LP compensation as Coinbase plans to delist SAND futures on August 26.
Exploit Hits Base and BSC Bridges
Sandbox, the metaverse gaming platform behind the SAND token, contained a vulnerability affecting its cross-chain bridges on Base and BNB Good Chain (BSC). An attacker exploited the bridges’ minting mechanism to create SAND tokens with no actual backing on each networks. The Sandbox disabled bridging on Base and BSC as quickly because the exploit was detected, chopping off the attacker’s capability to maneuver the fabricated tokens additional.
The Sandbox’s bridge infrastructure usually works by locking SAND on one chain, sometimes Ethereum, and minting an equal, totally backed quantity on the vacation spot community. That 1:1 backing mannequin is what broke down on this incident, permitting tokens to be minted on Base and BSC with out a matching lock on the supply chain.
A 14.9 Billion Token Anomaly
Peckshield recognized roughly 14.9 billion unbacked SAND minted throughout two addresses tied to the exploit. The size of that determine stands out given SAND’s legit complete provide is capped at 3 billion tokens, that means the minted quantity was practically 5 instances bigger than each actual SAND token that has ever existed or will exist.
The mismatch is frequent in bridge exploits, the place an attacker manipulates a sensible contract’s mint operate slightly than really stealing locked collateral. Related mint-based assaults have hit different protocols all year long, together with a bridge exploit that permit an attacker mint 1 billion unauthorized DOT tokens on Polkadot’s bridge earlier in 2026, and a smaller incident the place roughly 13.76 million unbacked ALPH tokens had been created on the Alephium bridge.
In every case, the fabricated tokens carried no actual worth and could possibly be neutralized as soon as the affected chain froze the exploited contract.
The Sandbox mentioned the incident affected lower than 0.01% of SAND’s complete provide by way of real backing in danger. SAND held on Ethereum and Polygon, person wallets throughout the ecosystem, and the Ethereum-locked property that again the token remained untouched all through the exploit, the corporate mentioned.
The platform is now getting ready a compensation plan for eligible liquidity suppliers who held positions affected by the unbacked minting, and it has suggested customers to not commerce SAND on Base or BSC till the bridges are restored.
A part of a Larger Bridge Safety Drawback
Bridge exploits have topped $320 million in losses throughout the crypto trade over the primary half of the 12 months, as attackers have more and more began concentrating on the good contracts that join separate blockchains slightly than particular person protocols. Bitcoin.com Information has tracked the same sample in latest months, together with the Gravity Bridge exploit that noticed a hacker drain $5.4 million and route the funds via Binance earlier than the path went chilly.
Furthermore, it bears mentioning that SAND was already dealing with stress impartial of the exploit, with its token buying and selling close to $0.039 as of this week, and Coinbase saying its plans to delist ten perpetual futures contracts, together with SAND, efficient August 26, as a part of a broader evaluation of buying and selling quantity and liquidity throughout its derivatives markets.
Open positions shall be settled mechanically at that time, including a second supply of near-term volatility on high of the bridge incident.
The following step for The Sandbox is a autopsy on how the bridge’s minting controls failed and a safety audit earlier than Base and BSC bridging is switched again on.