SAND bridge exploit: The Sandbox contains unbacked mint on Base and BSC

The Sandbox said on August 22, 2026 that it identified and fully contained a vulnerability in the SAND cross-chain bridge on Base and BNB Smart Chain (BSC). An attacker minted unbacked SAND on those two networks. If you hold or trade SAND there, treat that liquidity as compromised until the team restores a backed path.

Background

The Sandbox is a long-running Web3 gaming world whose utility token, SAND, is an ERC-20 on Ethereum, with bridged deployments on other chains. Bridging usually locks SAND on Ethereum and mints a matching balance on the destination. If someone mints SAND on Base or BSC without locking the same amount on Ethereum, you can still hold a balance labeled SAND on those chains, but it is not backed by locked SAND on Ethereum.

What happened

Official containment (August 22, 2026)

In an official X post⁠ (opens in new tab), The Sandbox said:

• Bridging to and from Base and BSC is disabled
• SAND on those networks is isolated and cannot be moved or redeemed through the bridge
• Ethereum and Polygon SAND are not affected; locked Ethereum reserves that back bridged SAND stay intact
• No user wallets were compromised; holders and liquidity providers on Ethereum and Polygon need no emergency action on those networks
• Direct impact is less than 0.01% of total SAND supply
• Do not buy, sell, or trade SAND on Base or BSC while liquidity there is compromised
• The team is taking a pre-incident snapshot and preparing compensation for qualified users of impacted liquidity pools (contact@sandbox.game)
• A full incident report and technical post-mortem will follow

The Defiant⁠ (opens in new tab) summarized the same points and noted that South Korean exchanges Upbit and Bithumb had already frozen SAND deposits and withdrawals while they reviewed the incident.

How researchers describe the exploit

Security coverage attributes the Base-side failure to LayerZero’s Omnichain Fungible Token (OFT) contracts, not to a break of Ethereum’s SAND max supply.

Blockaid⁠ (opens in new tab), cited by The Defiant, said attackers took over LayerZero delegate permissions through an approveAndCall path on the SAND OFT contract on Base. Those permissions control who may mint on a destination chain. Blockaid valued the minted tokens at about $49 billion across hundreds of transactions while minting was still running. That number only multiplies the new Base balances by the last traded SAND price. It is not what the attacker took from Ethereum reserves.

PeckShield⁠ (opens in new tab) flagged about 14.9 billion SAND minted to two addresses. A longer crypto.news⁠ (opens in new tab) reconstruction puts Base-side minting near 329.24 trillion SAND across 703 events to 173 addresses from about 23:42 UTC on August 21 through 04:45 UTC on August 22. About 24 minutes later, The Sandbox used its multisig wallet to disconnect Base and BSC from the LayerZero bridge path, so those networks could no longer send or receive official bridge messages.

Those mint counts disagree with each other and with the studio’s <0.01% impact line. Treat them as estimates of how much unbacked SAND appeared on Base and BSC, and wait for The Sandbox’s promised post-mortem before treating any one number as final.

What actually left Ethereum reserves

Independent write-ups, including crypto.news⁠ (opens in new tab), cite forensics that about 14.75 million SAND left the Ethereum-side bridge lock in under a minute, later sold for roughly 80 ETH (about $675,000 at the time of those trades). Against SAND’s 3 billion max supply, that withdrawal is small, even though the Base and BSC mint numbers look huge.

Secondary damage sits in DEX liquidity pools on Base and BSC that held real SAND against ETH or stables. Unbacked SAND dumped into those pools can hurt liquidity providers beyond the Ethereum reserve withdrawal. The studio’s snapshot-plus-compensation plan is aimed at that group. Eligibility rules and payout timing were not published as of August 23 coverage.

Who it affects

Holders on Ethereum or Polygon

Your SAND on Ethereum or Polygon is the balance The Sandbox says stayed safe. You do not need to move it because of this bridge incident. Still ignore DMs and reply links that claim “migration” or “rescue” help. The studio says it never messages first.

Holders and traders on Base or BSC

Do not buy, sell, or add liquidity to SAND on Base or BSC while the official warning stands. Isolated SAND there does not give you a backed redeem path to Ethereum through the disabled bridge. If you already provided liquidity on those networks, keep your own pre-incident records (wallet history, pool positions, timestamps) and watch official channels for the snapshot and claim steps. Use contact@sandbox.game only through channels you verify yourself.

Centralized exchange users

Deposit and withdrawal freezes at exchanges such as Upbit and Bithumb can stay in place even when spot trading stays open. Check each exchange notice before you try to move SAND. Coverage also noted Coinbase removing SAND perpetual futures as a risk control. That is a derivatives listing change, not a statement that Ethereum SAND supply changed.

At a glance

On Web3Raider

The Sandbox and SAND are not in the games or tokens catalogs. Closest pages:

• Blockchain hub: /blockchain
• Games hub: /games
• Networks: Base, Ethereum, Polygon
• Related Sandbox piece: Studio Beta Engine 14

What to watch next

• The Sandbox X account⁠ (opens in new tab) for the incident report, post-mortem, and compensation rules
• Official support only at addresses The Sandbox publishes (the announcement named contact@sandbox.game)
• Whether Base and BSC bridging returns, and under what contract changes
• Exchange notices from Upbit, Bithumb, and any other exchange that paused SAND transfers

Bottom line: Treat Base and BSC SAND as isolated until The Sandbox publishes a backed restore path and compensation rules. Leave Ethereum and Polygon balances alone unless an official channel tells you otherwise, and reject anyone who DMs a “bridge rescue” first.