Sandbox halts Base and BNB Chain bridging after exploit mints billions of unbacked SAND tokens

The Sandbox disclosed on August 22 that a malicious actor exploited a vulnerability in its SAND cross-chain bridge on Base and BNB Smart Chain, prompting the gaming platform to suspend all cross-chain transfers and freeze the token’s functionality on both networks. The attacker leveraged LayerZero’s Omnichain Fungible Token (OFT) standard to mint unbacked SAND tokens by compromising bridge delegate permissions through the approveAndCall function. On-chain monitoring flagged minting volumes with a face-value estimate of roughly $49 billion, a number that sounds apocalyptic until you look at what actually moved. The gap between what was minted and what was moved Approximately 14.9 billion SAND were minted to specific addresses during the exploit. That figure, on paper, dwarfs the token’s total supply of 3 billion. But the real amount that appears to have been transferred to usable wallets is closer to 14.75 million SAND. The Sandbox itself assessed the direct impact at less than 0.01% of total supply. The affected tokens on Base and BSC are now isolated, non-transferable, and non-redeemable against Ethereum-backed reserves. The Sandbox has explicitly warned users not to trade these t...