by Coinstrooper Crypto Articles
Quick Take
  • The project put the impact at under 0.01% of the total SAND supply.
  • It said that tokens on Ethereum (ETH) and Polygon (POL) are unaffected and that no user wallets were compromised.
  • The firm said attackers hijacked LayerZero delegate permissions through the approveAndCall function.
  • “~$49B face-value SAND minted so far across ~400+ txs,” Blockaid said.

What Happened

Sandbox Becomes Latest Project Reportedly Hit by an Exploit

The incident fits a wider pattern. DefiLlama has logged 17 separate exploits so far this month, most of them small, with bridges again the recurring weak point.

The post The Sandbox Contains Bridge Exploit After Unbacked SAND Minted on Base and BSC appeared first on BeInCrypto.

Market Context

The project told holders not to buy, sell, or trade SAND on either network, warning that liquidity there is compromised. It is taking a pre-incident snapshot and preparing compensation for qualifying liquidity providers, with a full post-mortem promised.

Why It Matters

The project put the impact at under 0.01% of the total SAND supply. It said that tokens on Ethereum (ETH) and Polygon (POL) are unaffected and that no user wallets were compromised.

Upbit imposed a halt on the Ethereum version of SAND, which the project has since said was never at risk.

Details

The Sandbox said it has contained a vulnerability in the SAND cross-chain bridge on Base and BNB Smart Chain after an attacker minted unbacked tokens on both networks.

Blockaid flagged the incident on Saturday. The firm said attackers hijacked LayerZero delegate permissions through the approveAndCall function.

“~$49B face-value SAND minted so far across ~400+ txs,” Blockaid said.

Follow us on X to get the latest news as it happens

The team said that it has disabled bridging to and from Base and BSC, cutting off any route to move or redeem the minted supply. It said the SAND locked on Ethereum, which backs all bridged tokens, remains intact.

“An attacker was able to mint unbacked SAND on Base and BSC. We have disabled bridging to and from both networks, so SAND on Base and BSC is currently isolated and cannot be moved or redeemed,” the post read.

Korean Exchanges Halt SAND Transfers

Meanwhile, Bithumb suspended SAND deposits and withdrawals at 11:11 a.m. KST, and Upbit followed one minute later. Both cited suspected security incidents under South Korea’s Virtual Asset User Protection Act.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights