Key Points
- A security breach on The Sandbox’s Base network implementation enabled unauthorized minting of approximately 14.9 billion SAND tokens without proper backing
- Real financial damage totaled around 14.75 million SAND extracted from Ethereum, yielding attackers roughly $675,000 (80 ETH)
- The Sandbox immediately disabled bridge functionality on Base and BNB Smart Chain networks
- Major South Korean cryptocurrency platforms Upbit and Bithumb paused SAND deposit and withdrawal services
- SAND tokens on Ethereum and Polygon networks remained secure, with no user wallet compromises reported
An unauthorized actor successfully obtained unrestricted minting privileges on The Sandbox’s SAND token contract operating on Base on August 22, 2026. The compromised contract was a Layer Zero Omnichain Fungible Token implementation designed to facilitate cross-chain token transfers.
The perpetrator leveraged an “approveAndCall” mechanism to compromise LayerZero delegate authorization. This manipulation granted them the ability to create tokens on Base without corresponding collateral from authentic SAND reserves locked on Ethereum.
Cybersecurity company Blockaid detected the ongoing breach in real-time. PeckShield independently verified that approximately 14.9 billion SAND tokens were generated across two distinct wallet addresses, a quantity dramatically surpassing the token’s official 3 billion total supply on Ethereum’s primary network.
The widely circulated $49 billion figure derives from multiplying SAND’s current trading price by the volume of unbacked tokens created. This calculation does not reflect actual stolen assets. The amount vastly exceeds market liquidity and represents unrealizable theoretical value.
The genuine financial impact proved considerably smaller. BlockWatchdog documented that roughly 14.75 million SAND was extracted from the Ethereum OFT Adapter within 60 seconds, generating approximately 80 ETH in tangible proceeds, equivalent to about $675,000.
According to The Sandbox’s assessment, the vulnerability impacted less than 0.01% of SAND’s total 3 billion token circulation when calculated through direct measurement.
The Sandbox’s Emergency Response Measures
The development team immediately deactivated bridge operations connecting Base and BNB Smart Chain, rendering tokens on these networks immobile and non-redeemable. The project’s multisignature wallet additionally removed LayerZero peer connections for Ethereum and BNB Smart Chain, completely isolating the Base network.
Users received explicit warnings against purchasing, selling, or exchanging SAND on Base or BNB networks due to corrupted liquidity conditions. SAND tokens operating on Ethereum and Polygon were verified as uncompromised. The collateral SAND locked on Ethereum supporting cross-chain tokens maintained complete integrity.
South Korean trading platforms responded swiftly to the emergency. Upbit published a trading advisory while Bithumb completely suspended SAND deposit and withdrawal functionality following blockchain monitoring alerts that identified the security breach.
The Sandbox, operating as a subsidiary of Animoca Brands following a $93 million fundraising round in 2021, announced plans to capture blockchain state data from before the incident and develop compensation mechanisms for eligible participants in affected liquidity pools.
A comprehensive technical analysis detailing the root cause is forthcoming. As of this writing, the development team has not released a complete public explanation regarding the vulnerability’s underlying mechanism.
SAND’s price declined approximately 10% during the trading day following the security incident but recovered to show only 0.8% losses across the full 24-hour window.

This security breach underscores an established vulnerability inherent to cross-chain token architecture. While generating tokens on secondary blockchain networks doesn’t increase Ethereum supply, these unbacked assets can nevertheless reach trading platforms and create downward price pressure.
Market participants should track announcements from Upbit and Bithumb regarding trading service restoration timelines and await The Sandbox’s official remediation or token burn strategy.


