The Sandbox has eliminated a critical vulnerability: the issuance of 14.9 billion fake SAND was prevented.

The team behind the metaverse The Sandbox has successfully neutralized a serious security threat related to the unauthorized issuance of SAND tokens. During the incident, the attacker managed to generate a colossal 14.9 billion unbacked tokens on the Base and BSC networks, which is several times the total supply of the original asset on Ethereum.

For context: the legitimate issuance of SAND on the Ethereum mainnet is limited to 3 billion tokens, with a market value estimated at approximately $140 million. Thus, the volume of compromised assets is 5 times greater than all existing supply, which could have led to a catastrophic price collapse and complete destabilization of the project's ecosystem.

Scope of the threat and response measures

The developers promptly blocked all cross-chain operations and isolated the attacker's tokens on the original blockchains, preventing their movement to other networks. This approach made it possible to contain the problem at an early stage and prevent the spread of fake assets through liquidity bridges.

It is important to emphasize that user wallets were not affected — the incident impacted only 0.01% of the total SAND in circulation. This indicates that the attack was aimed at infrastructure issuance mechanisms rather than the funds of end holders.

Nevertheless, this case serves as a warning signal for the entire industry. Vulnerabilities in cross-chain bridges and inter-network interaction mechanisms continue to be a primary target for hackers. The fact that the attacker managed to find a breach in the issuance system highlights the need for stricter smart contract audits and the implementation of multi-level transaction verification systems.

My analysis: Although the The Sandbox team acted quickly and professionally, such incidents undermine confidence in the security of metaverses. Investors should pay closer attention to projects with active cross-chain expansion, and developers should consider implementing automated systems for real-time monitoring of anomalous issuance. Otherwise, the next similar case could end not with containment but with a complete collapse.