The Sandbox ecosystem has faced a serious challenge: attackers exploited a vulnerability in the SAND token cross-chain bridge between the Base and BNB Smart Chain networks. As a result of the attack, unbacked tokens were generated in both networks, threatening the integrity of the project's liquidity.
The scale of the incident turned out to be limited but telling. In my estimation, the total volume of fake SAND issuance amounted to approximately $49 million, distributed across more than 400 transactions. However, the team responded promptly by disabling the bridge and blocking the ability to move or recover compromised assets. Notably, tokens on the Ethereum and Polygon networks remained untouched, and user wallets were not hacked.
Attack mechanics and market reaction
Analysis shows that the attacker intercepted LayerZero delegate rights through the approveAndCall function, allowing them to mint tokens without corresponding backing. The Sandbox team confirmed that the damage amounted to less than 0.01% of the total SAND supply, but warned holders about the illiquidity of assets on the Base and BSC networks.
The market reacted immediately: South Korean exchanges Bithumb and Upbit suspended SAND deposits and withdrawals, citing security breaches and local virtual asset protection legislation. Upbit even halted operations with the Ethereum network version of SAND, despite the team's assurances of its safety.
This incident is yet another reminder that bridges remain the most vulnerable link in DeFi infrastructure. According to DefiLlama, there have been 17 hacks in the past month, and most of them were attacks on cross-chain solutions. The Sandbox developers are preparing a network snapshot to compensate affected liquidity providers, and a full report on the incident is promised to be published later.
My conclusion: although the damage turned out to be minimal, this case highlights the critical importance of auditing and monitoring bridge contracts. Investors should exercise increased caution when working with assets in new networks until the ecosystem fully restores trust in its cross-chain mechanisms.