{"investigation":{"slug":"the-sandbox-sand-oft-exploit","entity_name":"The Sandbox (SAND OFT Exploit)","trust_score":36,"severity_base":null,"score_modifier":-8,"confidence":0.8,"status":"published","content_type":"investigation","summary":"On August 21-22, 2026, an attacker exploited a configuration flaw in The Sandbox's SAND omnichain fungible token (OFT) contract on Base, abusing the approveAndCall function to hijack LayerZero delegate permissions and mint 329.24 trillion unbacked SAND across 703 events over roughly five hours. Despite a headline face value of about $49 billion, realised losses were about 14.75 million SAND drained from the Ethereum OFT Adapter and sold for roughly 80 ETH (about $675,000). The Sandbox halted its Base and BNB Smart Chain bridges, retired the compromised contracts and on August 27, 2026 announced a 1:1 treasury-funded compensation plan based on pre-exploit snapshots; the incident was the third reported LayerZero OFT-related exploit of 2026.","sections":[{"content":"At approximately 23:42:05 UTC on August 21, 2026, an attacker began exploiting The Sandbox's SAND omnichain fungible token (OFT) contract deployed on the Base network. Security firm Blockaid, which flagged the incident publicly while it was still in progress, reported that the attacker had taken over LayerZero delegate permissions through SAND's approveAndCall function and was minting unbacked SAND at scale. Minting ended at approximately 04:45:21 UTC on August 22, after about five hours. By then 329.24 trillion unbacked SAND had been minted across 703 events; one account puts the recipients at 173 addresses. Blockaid's alert cited roughly $49 billion in face-value SAND minted across more than 400 transactions. PeckShield separately counted approximately 14.9 billion SAND sent to two attacker-controlled addresses, 0xAbE0...4D22 and 0x638C...F296; the latter reportedly held about 250 million SAND at the time of reporting. The differing totals reflect different counting methods and measurement windows during the multi-hour attack. Pages differ on where the minting took place: some accounts describe unbacked SAND minted on Base only, others on both Base and BNB Smart Chain. The canonical 3 billion SAND supply on Ethereum was not altered, no individual user wallets were reported compromised, and SAND on Ethereum and Polygon was unaffected. The attacker address had reportedly been dormant for 313 days before the attack, and its Relay Solver was funded 313 days before execution, which suggests deliberate pre-positioning.","heading":"Exploit","sources":[{"url":"https://x.com/blockaid_/status/2091016046555582891","name":"Blockaid on X: real-time exploit detection alert","type":"social_media","credibility":2},{"url":"https://x.com/PeckShieldAlert/status/2091037704314339331","name":"PeckShieldAlert on X: 14.9B SAND minted across 2 addresses","type":"social_media","credibility":3},{"url":"https://crypto.news/sandbox-bridge-exploit-49-billion-phantom-sand-mint/","name":"Crypto.news: The Sandbox's $49 billion phantom mint","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/","name":"CryptoTimes: Sandbox SAND Hacked — Attackers Mint 329 Trillion Tokens on Base in 5-Hour Rampage","type":"news_article","credibility":2},{"url":"https://coinpaprika.com/news/sandbox-halts-base-bnb-bridges-exploit-49b/","name":"CoinPaprika: The Sandbox Halts Base and BNB Bridges After Exploit Mints $49B in Phantom SAND","type":"news_article","credibility":2},{"url":"https://cryptobriefing.com/sandbox-halts-bridging-sand-exploit/","name":"CryptoBriefing: Sandbox halts Base and BNB Chain bridging after exploit mints billions of unbacked SAND tokens","type":"news_article","credibility":2},{"url":"https://blockonomi.com/the-sandbox-sand-bridge-exploit-attacker-mints-14-9b-unbacked-tokens-on-base-network","name":"Blockonomi: The Sandbox (SAND) Bridge Exploit — Attacker Mints 14.9B Unbacked Tokens on Base Network","type":"news_article","credibility":2},{"url":"https://pro.edgex.exchange/en-US/news/article/sandbox-bridge-exploit-49b-vs-675k-drain","name":"EdgeX: Sandbox Exploit Created $49B in Unbacked SAND Nobody Could Cash Out","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The root cause was a configuration flaw in The Sandbox's OFT bridge contracts on Base and BNB Smart Chain, not a vulnerability in the LayerZero protocol itself; Blockaid described it as an application-level configuration issue. approveAndCall is an ERC-20 extension designed as a user-experience shortcut that bundles a token approval and a follow-on contract call into one transaction. The attacker routed a crafted payload through this function into the LayerZero endpoint, which gave an attacker-controlled helper contract the standing of a LayerZero delegate, with administrative rights over the Base OFT contract. With that authority the attacker could instruct the OFT contract to mint SAND without a corresponding burn or lock of SAND on Ethereum, subverting the lock-and-mint model that OFT bridges rely on. According to the survivor page's account of The Sandbox's post-mortem, the configuration flaw let the attacker become the sole verifier for bridge messages on those deployments. The EdgeX analysis cautioned that framing the incident as 'LayerZero was hacked' overstates what has been confirmed: the confirmed issue is that delegate permissions tied to The Sandbox's specific OFT deployment were abused. LayerZero had not formally responded to the incident in the reporting available. Brinztech's incident report of August 28, 2026 classified the event as a critical configuration and permission flaw in the SAND OFT bridge infrastructure.","heading":"Technical root cause: approveAndCall and LayerZero delegate hijacking","sources":[{"url":"https://crypto.news/sandbox-bridge-exploit-49-billion-phantom-sand-mint/","name":"Crypto.news: The Sandbox's $49 billion phantom mint — technical breakdown","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/","name":"CryptoTimes: Sandbox SAND Hacked — technical details","type":"news_article","credibility":2},{"url":"https://cryptorank.io/news/feed/49fcb-the-sandbox-sand-exploit-49b-in-new-tokens-flood-base","name":"CryptoRank: The Sandbox SAND Exploit — $49B in New Tokens Flood Base","type":"news_article","credibility":2},{"url":"https://www.brinztech.com/breach-alerts/brinztech-incident-report-cross-chain-bridge-configuration-flaw-leads-to-unbacked-token-minting-on-base-and-bnb-smart-chain-the-sandbox-sand-incident","name":"Brinztech Incident Report: Cross-Chain Bridge Configuration Flaw","type":"research","credibility":2},{"url":"https://crypto.news/sand-bridge-exploit-contained-unbacked-token-mint/","name":"Crypto.news: SAND bridge exploit contained after unbacked token mint","type":"news_article","credibility":2},{"url":"https://pro.edgex.exchange/en-US/news/article/sandbox-bridge-exploit-49b-vs-675k-drain","name":"EdgeX: Sandbox Exploit Created $49B in Unbacked SAND Nobody Could Cash Out","type":"news_article","credibility":2},{"url":"https://blockonomi.com/the-sandbox-sand-bridge-exploit-attacker-mints-14-9b-unbacked-tokens-on-base-network","name":"Blockonomi: The Sandbox (SAND) Bridge Exploit — Attacker Mints 14.9B Unbacked Tokens on Base Network","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The widely repeated $49 billion figure is the market price of SAND applied to the 329.24 trillion unbacked tokens minted. It is not value the attacker extracted. The minted amount exceeded the legitimate 3 billion SAND supply roughly 110,000-fold, so no market could have absorbed even a small fraction at the quoted price. EdgeX described the headline figure as 'more than 70,000 times larger than the estimated reserve drain.' The realised loss came from the Ethereum OFT Adapter, the contract holding the real SAND that backs bridged supply: approximately 14.75 million SAND (14,769,723 SAND in one account) was drained from it in under 60 seconds through what appeared to be automated withdrawal scripts executing six transactions across 24 seconds. After the drain the adapter's balance stood at 0.0056 SAND, so no further legitimate SAND could be extracted however many unbacked tokens were minted. Reports differ on when the drain happened: one account places it at approximately 01:22:11 UTC on August 22, about an hour and forty minutes into the attack, while another says it took place within the first minute of the attack. Only this Ethereum-backed portion could be converted through the official bridge; the rest of the minted tokens had no backing and could not be redeemed. Reports also differ slightly on the proceeds: the drained SAND was sold for about 79.74 ETH, valued at roughly $675,000 (CryptoTimes and the survivor page), 'approximately 80 ETH' worth an estimated $665,000 to $675,000 (the PeckShield-based account), and later compensation coverage put the theft at $697,000 (Crypto Economy) and about $700,000 (CryptoBreaking). The Sandbox stated that the impact was less than 0.01% of the 3 billion SAND supply.","heading":"Actual losses versus headline figures","sources":[{"url":"https://crypto.news/sandbox-bridge-exploit-49-billion-phantom-sand-mint/","name":"Crypto.news: The Sandbox's $49 billion phantom mint","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/","name":"CryptoTimes: Sandbox SAND Hacked","type":"news_article","credibility":2},{"url":"https://pro.edgex.exchange/en-US/news/article/sandbox-bridge-exploit-49b-vs-675k-drain","name":"EdgeX: Sandbox Exploit Created $49B in Unbacked SAND Nobody Could Cash Out","type":"news_article","credibility":2},{"url":"https://coinspectator.com/cryptonews/2026/08/30/the-sandbox-minted-329-trillion-unbacked-sand-tokens-in-5-hours-and-only-675k-was-stolen/","name":"CoinSpectator: The Sandbox minted 329 trillion unbacked SAND tokens in 5 hours and only $675K was stolen","type":"news_article","credibility":2},{"url":"https://x.com/PeckShieldAlert/status/2091037704314339331","name":"PeckShieldAlert on X: 14.9B SAND minted across 2 addresses","type":"social_media","credibility":3},{"url":"https://news.bitcoin.com/security/sandbox-sand-bridge-exploit-unbacked-tokens/","name":"Bitcoin.com News: Sandbox Bridge Hack Mints 14.9B SAND While Coinbase Delists Futures","type":"news_article","credibility":2},{"url":"https://beincrypto.com/sandbox-sand-bridge-exploit-base-bsc/","name":"BeInCrypto: The Sandbox Contains Bridge Exploit After Unbacked SAND Minted on Base and BSC","type":"news_article","credibility":2},{"url":"https://crypto-economy.com/the-sandbox-to-fully-refund-bridge-exploit-victims-after-697k-sand-theft/","name":"Crypto Economy: The Sandbox to Fully Refund Bridge Exploit Victims After $697K SAND Theft","type":"news_article","credibility":2},{"url":"https://www.cryptobreaking.com/the-sandbox-commits-to-11/","name":"CryptoBreaking: The Sandbox Commits to 1:1 Refund After $700K Bridge Exploit","type":"news_article","credibility":2}],"severity":"high"},{"content":"The Sandbox disclosed the breach on August 22, 2026 and disabled bridging on Base and BNB Smart Chain. At approximately 05:09:19 UTC, 24 minutes after minting stopped and about five and a half hours after the attack began, the project's multisig removed the LayerZero peer settings. One account says it zeroed the trusted peers for endpoint IDs 30101 (Ethereum) and 30102 (Base), cutting the Base OFT contract off from the Ethereum adapter. SAND on Ethereum and Polygon stayed operational throughout. The Sandbox's official statement read: 'The Sandbox team has identified and fully contained a recent vulnerability regarding the SAND cross-chain bridge on Base and BNB Smart Chain (BSC). The impact is minimal, representing less than 0.01% of the total SAND token supply.' It added: 'All bridged SAND funds are backed by SAND locked on Ethereum, which remains entirely secure.' The Sandbox described the unbacked tokens on Base and BNB Smart Chain as isolated, non-transferable and non-redeemable against Ethereum-backed reserves. It warned users not to trade SAND on those networks, saying the tokens carried 'zero backing and will likely never be honored.' The compromised bridge contracts on Base and BNB Smart Chain were permanently retired and will not be restored; replacement contracts are expected once security review is complete. Initial reporting said The Sandbox would compensate eligible liquidity providers from a pre-incident snapshot, following the precedent of the Wormhole (2022) and Ronin (2022) recoveries. As of August 27, 2026, the methodology, payment currency and schedule had not been disclosed, and no bridge restoration timeline had been announced.","heading":"Containment and response","sources":[{"url":"https://www.coindesk.com/web3/2026/08/22/web3-gaming-network-sandbox-stops-base-and-bnb-chain-bridging-after-exploit","name":"CoinDesk: Web3 gaming network Sandbox stops Base and BNB chain bridging after exploit","type":"news_article","credibility":1},{"url":"https://crypto.news/sand-bridge-exploit-contained-unbacked-token-mint/","name":"Crypto.news: SAND bridge exploit contained after unbacked token mint","type":"news_article","credibility":2},{"url":"https://coinpaprika.com/news/sandbox-halts-base-bnb-bridges-exploit-49b/","name":"CoinPaprika: The Sandbox Halts Base and BNB Bridges After Exploit Mints $49B in Phantom SAND","type":"news_article","credibility":2},{"url":"https://castlecrypto.gg/news/the-sandbox-isolates-cross-chain-bridge-vulnerability-on-base-and-bsc/","name":"Castle Crypto: The Sandbox Isolates Cross Chain Bridge Vulnerability on Base and BSC","type":"news_article","credibility":2},{"url":"https://beincrypto.com/sandbox-sand-bridge-exploit-base-bsc/","name":"BeInCrypto: The Sandbox Contains Bridge Exploit After Unbacked SAND Minted on Base and BSC","type":"news_article","credibility":2},{"url":"https://cryptobriefing.com/sandbox-halts-bridging-sand-exploit/","name":"CryptoBriefing: Sandbox halts Base and BNB Chain bridging after exploit mints billions of unbacked SAND tokens","type":"news_article","credibility":2},{"url":"https://cryptobriefing.com/sandbox-security-breach-500m-sand-minted/","name":"CryptoBriefing: The Sandbox security breach","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/","name":"CryptoTimes: Sandbox SAND Hacked","type":"news_article","credibility":2}],"severity":"medium"},{"content":"On August 27, 2026, The Sandbox announced a 1:1 compensation plan for wallets that legitimately held bridged SAND on Base or BNB Smart Chain at the time of the exploit. Eligibility is based on on-chain snapshots taken immediately before the unauthorized minting began: Base block 50,283,176 and BSC block 117,321,965. Each eligible wallet is to receive an equal amount of Ethereum-based SAND. The compensation is funded entirely from The Sandbox treasury, and no new SAND will be minted, so the fixed 3 billion supply is preserved. A claims portal was expected to open within two weeks of the announcement, followed by a two-week submission window. Wallets holding balances through two major centralized exchanges, representing over 72% of affected SAND, were to be compensated directly by those exchanges without filing individual claims. Unclaimed compensation for wallets that miss the initial window was to become available on Base and BNB Smart Chain once replacement bridge contracts deploy. The total liability matches the roughly 14.75 million SAND drained, valued at about $675,000 to $700,000.","heading":"Compensation plan","sources":[{"url":"https://crypto.news/the-sandbox-to-reimburse-sand-holders-after-14-7m-token-bridge-exploit/","name":"Crypto.news: The Sandbox to reimburse SAND holders after 14.7M token bridge exploit","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/27/the-sandbox-sets-11-compensation-plan-for-base-and-bnb-chain-sand-holders/","name":"CryptoTimes: The Sandbox Sets 1:1 Compensation Plan for Base and BNB Chain SAND Holders","type":"news_article","credibility":2},{"url":"https://crypto-economy.com/the-sandbox-to-fully-refund-bridge-exploit-victims-after-697k-sand-theft/","name":"Crypto Economy: The Sandbox to Fully Refund Bridge Exploit Victims After $697K SAND Theft","type":"news_article","credibility":2},{"url":"https://www.cryptobreaking.com/the-sandbox-commits-to-11/","name":"CryptoBreaking: The Sandbox Commits to 1:1 Refund After $700K Bridge Exploit","type":"news_article","credibility":2}],"severity":"low"},{"content":"South Korean exchanges Upbit and Bithumb suspended SAND deposits and withdrawals on August 22, 2026, citing the security incident and the Virtual Asset User Protection Act. Accounts differ slightly on timing: one says both exchanges halted at 11:11 KST, another that Bithumb suspended at about 11:11 a.m. KST and Upbit followed shortly after. Spot trading continued on both platforms with price-volatility warnings. On August 24, Upbit designated SAND an investment warning asset under Article 17 of the Act, effective 15:00 KST, covering the SAND/KRW and SAND/BTC pairs. During the designation deposits cannot be processed and attempted deposits are returned. Upbit's review window runs through early October 2026, after which it will decide whether to lift, extend or end the designation. Bithumb's own review was reported to run from September 28 to October 2, 2026. As of August 24, reports said both exchanges were weighing a spot delisting, but no decision had been announced. Korean won pairs account for a disproportionate share of global SAND volume. Coinbase delisted SAND perpetual futures, effective August 26, 2026, as part of a batch of ten contracts that also included MEME, BIRB, BLUR, KAT, SPX, ZORA, AXS, AI and ZRO. Open positions were settled at the average price of the final hour of trading, and spot SAND trading was unaffected. Reports differ on whether the delisting was linked to the exploit: one account says Coinbase delisted SAND futures following the incident, while others note the delisting was part of a periodic ten-token review and that Coinbase did not formally cite the exploit, so a causal link is not established. SAND fell about 5.5% to 10% intraday across venues. CoinGecko marked it at $0.03879, and another report gave about $0.043 as of August 24, with market capitalization of about $113.7 million to $115 million. Spot volume rose to about 24 times baseline, futures open interest rose 16%, and funding rates turned sharply negative. Prices partly recovered as the limited size of the actual drain became more widely understood.","heading":"Exchange and market impact","sources":[{"url":"https://www.cryptotimes.io/2026/08/24/sand-faces-upbit-bithumb-delisting-risk-after-49b-mint-attack/","name":"CryptoTimes: SAND Faces Upbit, Bithumb Delisting Risk After $49B Mint Attack","type":"news_article","credibility":2},{"url":"https://cryptonews.net/news/security/33334239/","name":"CryptoNews.net: Upbit Warns, Bithumb Suspends SAND After 500M+ Token Mint Exploit on Base","type":"news_article","credibility":2},{"url":"https://cryptorank.io/news/feed/a9298-coinbase-delist-perpetual-futures-sand","name":"CryptoRank: Coinbase to Delist 10 Perpetual Futures Including SAND on Aug. 26","type":"news_article","credibility":2},{"url":"https://news.bitcoin.com/security/sandbox-sand-bridge-exploit-unbacked-tokens/","name":"Bitcoin.com News: Sandbox Bridge Hack Mints 14.9B SAND While Coinbase Delists Futures","type":"news_article","credibility":2},{"url":"https://crypto.news/sand-bridge-exploit-contained-unbacked-token-mint/","name":"Crypto.news: SAND bridge exploit contained after unbacked token mint","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/","name":"CryptoTimes: Sandbox SAND Hacked — market data","type":"news_article","credibility":2},{"url":"https://pro.edgex.exchange/en-US/news/article/sandbox-bridge-exploit-49b-vs-675k-drain","name":"EdgeX: Sandbox Exploit Created $49B in Unbacked SAND Nobody Could Cash Out","type":"news_article","credibility":2},{"url":"https://coinpaprika.com/news/sandbox-halts-base-bnb-bridges-exploit-49b/","name":"CoinPaprika: The Sandbox Halts Base and BNB Bridges After Exploit Mints $49B in Phantom SAND","type":"news_article","credibility":2}],"severity":"high"},{"content":"Crypto.news described the SAND incident as 'the third major LayerZero-related bridge exploit in five months.' In the first, on or around April 18, 2026, approximately 116,500 rsETH (about $292 million) was drained from KelpDAO's rsETH bridge through its Ethereum OFT Adapter. The attacker had earlier compromised a LayerZero Labs developer through social engineering and forged cross-chain messages through a single compromised Decentralized Verifier Network (DVN). LayerZero's post-mortem linked the breach to North Korea's Lazarus Group, which allegedly socially engineered the developer in March 2026 to harvest session keys. LayerZero Labs published its KelpDAO incident report on May 18, 2026 and attributed the vulnerability to Kelp's single-verifier (1-of-1 DVN) configuration rather than the recommended multi-DVN setup. Kelp disputed this, saying LayerZero personnel had reviewed and implicitly approved the configuration across eight integration meetings over 2.5 years; LayerZero CEO Bryan Pellegrino rejected that account. The dispute extended to about $71 million in exploit-linked ETH frozen on Arbitrum. In the second incident, on or around May 27, 2026, an attacker used a compromised deployer key to reset the trusted peer on Stake DAO's LayerZero v2 vsdCRV bridge, pointing it at a malicious contract that sent forged messages. This triggered 5.4 trillion unbacked vsdCRV mints on Arbitrum and extracted about 43.78 ETH (around $91,000). Blockaid, BlockSec and PeckShield confirmed no smart-contract bug was involved in that case; the vector was centralized key management, and the vsdCRV bridge between Ethereum and Arbitrum was permanently closed. The SAND exploit differs in mechanism, relying on an application-level approveAndCall configuration flaw rather than a compromised DVN or deployer key. Across the three incidents, attackers gained privileged administrative permissions, through social engineering, compromised keys or contract-level delegation abuse, and used them to mint unbacked tokens that bypassed the OFT framework's reserve checks. Sources note that the Sandbox and Stake DAO incidents may reflect abused administrative configurations rather than flaws in the LayerZero protocol itself, a distinction LayerZero also drew in the Kelp dispute.","heading":"Context: recurring LayerZero OFT exploits in 2026","sources":[{"url":"https://blockaid.io/blog/how-a-single-layerzero-dvn-compromise-drained-292m-from-kelpdao","name":"Blockaid Blog: How a Single LayerZero DVN Compromise Drained $292M from KelpDAO","type":"research","credibility":2},{"url":"https://layerzero.network/publications/kelpdao-incident-report.pdf","name":"LayerZero: LayerZero Labs KelpDAO Incident Report (PDF)","type":"official","credibility":1},{"url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","name":"CoinDesk: Kelp claims LayerZero approved setup it blamed for $292 million bridge hack","type":"news_article","credibility":1},{"url":"https://unchainedcrypto.com/kelp-dao-claims-layerzero-approved-the-setup-it-blamed-for-292-million-hack-migrates-to-chainlink/","name":"Unchained: Kelp DAO claims LayerZero approved setup blamed for $292M hack, migrates to Chainlink","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/400131/kelp-dao-ditches-layerzero-chainlink-cross-chain-infrastructure-292-million-exploit","name":"The Block: Kelp DAO ditches LayerZero for Chainlink after $292M exploit","type":"news_article","credibility":1},{"url":"https://cryptobriefing.com/stake-dao-exploit-vsdcrv-arbitrum/","name":"CryptoBriefing: Stake DAO exploit: attacker mints 5.4T vsdCRV on Arbitrum","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/05/27/stake-dao-exploited-as-hacker-mints-5-4-trillion-fake-vsdcrv/","name":"CryptoTimes: Stake DAO exploited as hacker mints 5.4 trillion fake vsdCRV","type":"news_article","credibility":2},{"url":"https://crypto.news/sandbox-bridge-exploit-49-billion-phantom-sand-mint/","name":"Crypto.news: The Sandbox's $49 billion phantom mint","type":"news_article","credibility":2},{"url":"https://beincrypto.com/sandbox-sand-bridge-exploit-base-bsc/","name":"BeInCrypto: The Sandbox Contains Bridge Exploit After Unbacked SAND Minted on Base and BSC","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/24/sand-faces-upbit-bithumb-delisting-risk-after-49b-mint-attack/","name":"CryptoTimes: SAND Faces Upbit, Bithumb Delisting Risk — broader LayerZero context","type":"news_article","credibility":2}],"severity":"high"},{"content":"The three incidents accelerated an existing shift from LayerZero to Chainlink's Cross-Chain Interoperability Protocol (CCIP). As of about August 20, 2026, two days before the Sandbox incident, publicly announced migrations from LayerZero to CCIP totalled about $15 billion. The largest was BitGo's move of about $7.4 billion in wrapped Bitcoin (WBTC), and Wyoming's stablecoin infrastructure initiatives also moved to CCIP. Kelp DAO called itself 'the first major protocol to move away from LayerZero since the exploit.' The case made for CCIP rests on its requirement that multiple independent oracle networks approve each transfer, in contrast to the single-verifier or configurable DVN setups possible under LayerZero's OFT standard. The Sandbox had not announced a move to another cross-chain standard in the reporting available.","heading":"Industry migration from LayerZero to Chainlink CCIP","sources":[{"url":"https://en.cryptonomist.ch/2026/08/20/layerzero-crypto-migration-shift/","name":"CryptoNomist: LayerZero crypto migration hits $15B as BitGo, Wyoming exit to Chainlink","type":"news_article","credibility":2},{"url":"https://crypto.news/layerzero-chainlink-exodus-15-billion-bridge-migration/","name":"Crypto.news: $15B exodus: why crypto is leaving LayerZero for Chainlink","type":"news_article","credibility":2},{"url":"https://news.bitcoin.com/kelpdao-slams-layerzero-after-300m-exploit-shifts-rseth-to-chainlink-ccip/","name":"Bitcoin.com: KelpDAO slams LayerZero after $300M exploit, shifts rsETH to Chainlink CCIP","type":"news_article","credibility":2}],"severity":"medium"},{"content":"As of August 30, 2026, The Sandbox had not published a timeline for reopening the Base or BNB Smart Chain bridges, replacement bridge contracts had not been deployed, and the compensation claims portal had not opened. The Sandbox had not explicitly confirmed Blockaid's account of approveAndCall as the delegate-hijack vector, although that account is consistent with its description of a configuration flaw. Earlier reporting, up to August 27, noted that the project had promised but not yet published a full technical post-mortem. Animoca Brands, The Sandbox's parent company, had not made a public statement. No arrest or attribution of the attacker had been reported, and it is not established how, beyond the approveAndCall vector, the delegate permissions were obtained. LayerZero had not responded publicly to the Sandbox incident specifically. The Upbit and Bithumb reviews were ongoing, with outcomes expected in late September to early October 2026. The fate of the roughly 329 trillion unbacked tokens, whether they will be burned, stay frozen or be handled some other way, has not been addressed publicly. Users holding SAND on Base or BNB Smart Chain were advised to consult The Sandbox's official channels, because those tokens cannot be redeemed against Ethereum-backed reserves.","heading":"Open items and unresolved questions","sources":[{"url":"https://crypto.news/sand-bridge-exploit-contained-unbacked-token-mint/","name":"Crypto.news: SAND bridge exploit contained after unbacked token mint","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/27/the-sandbox-sets-11-compensation-plan-for-base-and-bnb-chain-sand-holders/","name":"CryptoTimes: The Sandbox Sets 1:1 Compensation Plan","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/08/24/sand-faces-upbit-bithumb-delisting-risk-after-49b-mint-attack/","name":"CryptoTimes: SAND Faces Upbit, Bithumb Delisting Risk After $49B Mint Attack","type":"news_article","credibility":2},{"url":"https://pro.edgex.exchange/en-US/news/article/sandbox-bridge-exploit-49b-vs-675k-drain","name":"EdgeX: Sandbox Exploit Created $49B in Unbacked SAND Nobody Could Cash Out","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2026-03","event":"LayerZero Labs developer allegedly socially engineered by North Korea's Lazarus Group, reportedly harvesting session keys later linked to the KelpDAO exploit.","source":"Unchained Crypto","source_url":"https://unchainedcrypto.com/kelp-dao-claims-layerzero-approved-the-setup-it-blamed-for-292-million-hack-migrates-to-chainlink/"},{"date":"2026-04","event":"KelpDAO's rsETH LayerZero bridge exploited (reported as April 18); approximately 116,500 rsETH (~$292 million) drained. LayerZero blamed Kelp's single-verifier configuration; Kelp disputed this.","source":"CoinDesk / The Block","source_url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack"},{"date":"2026-05","event":"LayerZero Labs publishes its KelpDAO incident report (stated as May 18, 2026).","source":"LayerZero","source_url":"https://layerzero.network/publications/kelpdao-incident-report.pdf"},{"date":"2026-05","event":"Stake DAO's vsdCRV LayerZero v2 bridge exploited via a compromised deployer key (reported as May 27); about 5.4 trillion unbacked vsdCRV minted on Arbitrum and roughly 43.78 ETH (~$91,000) extracted. Bridge permanently closed.","source":"CryptoBriefing / CryptoTimes","source_url":"https://cryptobriefing.com/stake-dao-exploit-vsdcrv-arbitrum/"},{"date":"2026-08","event":"Announced LayerZero-to-Chainlink CCIP migrations reach about $15 billion, led by BitGo's $7.4 billion WBTC move (reported August 20, two days before the Sandbox incident).","source":"CryptoNomist","source_url":"https://en.cryptonomist.ch/2026/08/20/layerzero-crypto-migration-shift/"},{"date":"2026-08","event":"Attack begins at approximately 23:42:05 UTC on August 21. Attacker abuses approveAndCall on SAND's OFT contract on Base to hijack LayerZero delegate permissions and begins minting unbacked SAND.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/"},{"date":"2026-08","event":"Ethereum OFT Adapter drained to near zero: approximately 14,769,723 SAND withdrawn and converted to roughly 79.74-80 ETH (~$675,000). One account places this at approximately 01:22:11 UTC on August 22; another says it occurred within the first minute of the attack.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/"},{"date":"2026-08","event":"Blockaid posts a real-time public alert on X citing about $49 billion face-value SAND minted across 400+ transactions; PeckShield separately reports 14.9 billion SAND minted to two attacker addresses.","source":"Blockaid / PeckShield on X","source_url":"https://x.com/blockaid_/status/2091016046555582891"},{"date":"2026-08","event":"Minting stops at approximately 04:45:21 UTC on August 22 after about five hours; 329.24 trillion unbacked SAND minted across 703 events.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/"},{"date":"2026-08","event":"The Sandbox multisig removes LayerZero peer settings at approximately 05:09:19 UTC on August 22, 24 minutes after minting stops. Base and BNB Smart Chain bridging disabled; Ethereum and Polygon SAND unaffected.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/"},{"date":"2026-08","event":"The Sandbox publicly confirms the breach, says impact is under 0.01% of total SAND supply and commits to LP compensation based on a pre-incident snapshot.","source":"CoinPaprika","source_url":"https://coinpaprika.com/news/sandbox-halts-base-bnb-bridges-exploit-49b/"},{"date":"2026-08","event":"Upbit and Bithumb suspend SAND deposits and withdrawals on August 22 (Bithumb at about 11:11 KST). SAND falls about 5.5-10% intraday.","source":"CryptoNews.net","source_url":"https://cryptonews.net/news/security/33334239/"},{"date":"2026-08","event":"Upbit designates SAND an investment warning asset effective 15:00 KST on August 24 under Article 17 of the Virtual Asset User Protection Act; reports say Upbit and Bithumb are weighing spot delisting.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/24/sand-faces-upbit-bithumb-delisting-risk-after-49b-mint-attack/"},{"date":"2026-08","event":"Coinbase delists SAND perpetual futures (effective August 26) in a batch of ten contracts; open positions auto-settled; spot SAND unaffected.","source":"CryptoRank","source_url":"https://cryptorank.io/news/feed/a9298-coinbase-delist-perpetual-futures-sand"},{"date":"2026-08","event":"The Sandbox announces (August 27) a 1:1 treasury-funded compensation plan using pre-exploit snapshots (Base block 50,283,176; BSC block 117,321,965); claims portal expected within two weeks.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/08/27/the-sandbox-sets-11-compensation-plan-for-base-and-bnb-chain-sand-holders/"},{"date":"2026-08","event":"Brinztech publishes (August 28) an incident report classifying the event as a critical configuration and permission flaw in the SAND OFT bridge infrastructure.","source":"Brinztech Breach Alerts","source_url":"https://www.brinztech.com/breach-alerts/brinztech-incident-report-cross-chain-bridge-configuration-flaw-leads-to-unbacked-token-minting-on-base-and-bnb-smart-chain-the-sandbox-sand-incident"}],"sources_used":[{"url":"https://crypto.news/sandbox-bridge-exploit-49-billion-phantom-sand-mint/","name":"Crypto.news: The Sandbox's $49 billion phantom mint","type":"news_article","archive_url":"http://web.archive.org/web/20260824222855/https://crypto.news/sandbox-bridge-exploit-49-billion-phantom-sand-mint/","credibility":2,"archive_timestamp":"2026-08-24T22:28:55+00:00"},{"url":"https://coinpaprika.com/news/sandbox-halts-base-bnb-bridges-exploit-49b/","name":"CoinPaprika: The Sandbox Halts Base and BNB Bridges After Exploit Mints $49B in Phantom SAND","type":"news_article","archive_url":"http://web.archive.org/web/20260826193741/https://coinpaprika.com/news/sandbox-halts-base-bnb-bridges-exploit-49b/","credibility":2,"archive_timestamp":"2026-08-26T19:37:41+00:00"},{"url":"https://cryptorank.io/news/feed/49fcb-the-sandbox-sand-exploit-49b-in-new-tokens-flood-base","name":"CryptoRank: The Sandbox SAND Exploit — $49B in New Tokens Flood Base","type":"news_article","archive_url":"http://web.archive.org/web/20260825004515/https://cryptorank.io/news/feed/49fcb-the-sandbox-sand-exploit-49b-in-new-tokens-flood-base","credibility":2,"archive_timestamp":"2026-08-25T00:45:15+00:00"},{"url":"https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/","name":"CryptoTimes: Sandbox SAND Hacked — Attackers Mint 329 Trillion Tokens on Base in 5-Hour Rampage","type":"news_article","archive_url":"http://web.archive.org/web/20260824181711/https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/","credibility":2,"archive_timestamp":"2026-08-24T18:17:11+00:00"},{"url":"https://www.coindesk.com/web3/2026/08/22/web3-gaming-network-sandbox-stops-base-and-bnb-chain-bridging-after-exploit","name":"CoinDesk: Web3 gaming network Sandbox stops Base and BNB chain bridging after exploit","type":"news_article","archive_url":"https://web.archive.org/web/20260915191641/https://www.coindesk.com/web3/2026/08/22/web3-gaming-network-sandbox-stops-base-and-bnb-chain-bridging-after-exploit","credibility":1,"archive_timestamp":"2026-09-15T19:16:41+00:00"},{"url":"https://thedefiant.io/news/hacks/the-sandbox-says-it-contained-bridge-exploit-that-minted-unbacked-sand-on-base-and-bsc","name":"The Defiant: The Sandbox Says It Contained Bridge Exploit That Minted Unbacked SAND on Base and BSC","type":"news_article","archive_url":"http://web.archive.org/web/20260822173735/https://thedefiant.io/news/hacks/the-sandbox-says-it-contained-bridge-exploit-that-minted-unbacked-sand-on-base-and-bsc","credibility":2,"archive_timestamp":"2026-08-22T17:37:35+00:00"},{"url":"https://x.com/blockaid_/status/2091016046555582891","name":"Blockaid on X: real-time exploit detection alert","type":"social_media","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://x.com/PeckShieldAlert/status/2091037704314339331","name":"PeckShieldAlert on X: 14.9B SAND minted across 2 addresses","type":"social_media","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://crypto.news/sand-bridge-exploit-contained-unbacked-token-mint/","name":"Crypto.news: SAND bridge exploit contained after unbacked token mint","type":"news_article","archive_url":"http://web.archive.org/web/20260824135319/https://crypto.news/sand-bridge-exploit-contained-unbacked-token-mint/","credibility":2,"archive_timestamp":"2026-08-24T13:53:19+00:00"},{"url":"https://www.cryptotimes.io/2026/08/24/sand-faces-upbit-bithumb-delisting-risk-after-49b-mint-attack/","name":"CryptoTimes: SAND Faces Upbit, Bithumb Delisting Risk After $49B Mint Attack","type":"news_article","archive_url":"http://web.archive.org/web/20260825030032/https://www.cryptotimes.io/2026/08/24/sand-faces-upbit-bithumb-delisting-risk-after-49b-mint-attack/","credibility":2,"archive_timestamp":"2026-08-25T03:00:32+00:00"},{"url":"https://crypto.news/the-sandbox-to-reimburse-sand-holders-after-14-7m-token-bridge-exploit/","name":"Crypto.news: The Sandbox to reimburse SAND holders after 14.7M token bridge exploit","type":"news_article","archive_url":"https://web.archive.org/web/20260902023841/https://crypto.news/the-sandbox-to-reimburse-sand-holders-after-14-7m-token-bridge-exploit/","credibility":2,"archive_timestamp":"2026-09-02T02:38:41+00:00"},{"url":"https://www.cryptotimes.io/2026/08/27/the-sandbox-sets-11-compensation-plan-for-base-and-bnb-chain-sand-holders/","name":"CryptoTimes: The Sandbox Sets 1:1 Compensation Plan for Base and BNB Chain SAND Holders","type":"news_article","archive_url":"https://web.archive.org/web/20260901124831/https://www.cryptotimes.io/2026/08/27/the-sandbox-sets-11-compensation-plan-for-base-and-bnb-chain-sand-holders/","credibility":2,"archive_timestamp":"2026-09-01T12:48:31+00:00"},{"url":"https://crypto-economy.com/the-sandbox-to-fully-refund-bridge-exploit-victims-after-697k-sand-theft/","name":"Crypto Economy: The Sandbox to Fully Refund Bridge Exploit Victims After $697K SAND Theft","type":"news_article","archive_url":"https://web.archive.org/web/20260901073712/https://crypto-economy.com/the-sandbox-to-fully-refund-bridge-exploit-victims-after-697k-sand-theft/","credibility":2,"archive_timestamp":"2026-09-01T07:37:12+00:00"},{"url":"https://www.cryptobreaking.com/the-sandbox-commits-to-11/","name":"CryptoBreaking: The Sandbox Commits to 1:1 Refund After $700K Bridge Exploit","type":"news_article","archive_url":"https://web.archive.org/web/20260901181942/https://www.cryptobreaking.com/the-sandbox-commits-to-11/","credibility":2,"archive_timestamp":"2026-09-01T18:19:42+00:00"},{"url":"https://pro.edgex.exchange/en-US/news/article/sandbox-bridge-exploit-49b-vs-675k-drain","name":"EdgeX: Sandbox Exploit Created $49B in Unbacked SAND Nobody Could Cash Out","type":"news_article","archive_url":"http://web.archive.org/web/20260824160242/https://pro.edgex.exchange/en-US/news/article/sandbox-bridge-exploit-49b-vs-675k-drain","credibility":2,"archive_timestamp":"2026-08-24T16:02:42+00:00"},{"url":"https://blockaid.io/blog/how-a-single-layerzero-dvn-compromise-drained-292m-from-kelpdao","name":"Blockaid Blog: How a Single LayerZero DVN Compromise Drained $292M from KelpDAO","type":"research","archive_url":"http://web.archive.org/web/20260515225319/https://blockaid.io/blog/how-a-single-layerzero-dvn-compromise-drained-292m-from-kelpdao","credibility":2,"archive_timestamp":"2026-05-15T22:53:19+00:00"},{"url":"https://layerzero.network/publications/kelpdao-incident-report.pdf","name":"LayerZero: LayerZero Labs KelpDAO Incident Report (PDF)","type":"official","archive_url":"http://web.archive.org/web/20260920082847/https://layerzero.network/publications/kelpdao-incident-report.pdf","credibility":1,"archive_timestamp":"2026-09-20T08:28:47+00:00"},{"url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","name":"CoinDesk: Kelp claims LayerZero approved setup it blamed for $292 million bridge hack","type":"news_article","archive_url":"http://web.archive.org/web/20260801083712/https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","credibility":1,"archive_timestamp":"2026-08-01T08:37:12+00:00"},{"url":"https://www.brinztech.com/breach-alerts/brinztech-incident-report-cross-chain-bridge-configuration-flaw-leads-to-unbacked-token-minting-on-base-and-bnb-smart-chain-the-sandbox-sand-incident","name":"Brinztech Incident Report: Cross-Chain Bridge Configuration Flaw","type":"research","archive_url":"https://web.archive.org/web/20260901045251/https://www.brinztech.com/breach-alerts/brinztech-incident-report-cross-chain-bridge-configuration-flaw-leads-to-unbacked-token-minting-on-base-and-bnb-smart-chain-the-sandbox-sand-incident","credibility":2,"archive_timestamp":"2026-09-01T04:52:51+00:00"},{"url":"https://coinspectator.com/cryptonews/2026/08/30/the-sandbox-minted-329-trillion-unbacked-sand-tokens-in-5-hours-and-only-675k-was-stolen/","name":"CoinSpectator: The Sandbox minted 329 trillion unbacked SAND tokens in 5 hours and only $675K was stolen","type":"news_article","archive_url":"https://web.archive.org/web/20260901073622/https://coinspectator.com/cryptonews/2026/08/30/the-sandbox-minted-329-trillion-unbacked-sand-tokens-in-5-hours-and-only-675k-was-stolen/","credibility":2,"archive_timestamp":"2026-09-01T07:36:22+00:00"},{"url":"https://shattered.io/sandbox-sand-bridge-exploit-2026/","name":"Shattered.io: SAND Bridge Exploit — 14.9B Tokens Minted Overnight","type":"news_article","archive_url":"http://web.archive.org/web/20260825004504/https://shattered.io/sandbox-sand-bridge-exploit-2026/","credibility":2,"archive_timestamp":"2026-08-25T00:45:04+00:00"},{"url":"https://blockonomi.com/the-sandbox-sand-bridge-exploit-attacker-mints-14-9b-unbacked-tokens-on-base-network","name":"Blockonomi: The Sandbox (SAND) Bridge Exploit — Attacker Mints 14.9B Unbacked Tokens on Base Network","type":"news_article","archive_url":"http://web.archive.org/web/20260826131623/https://blockonomi.com/the-sandbox-sand-bridge-exploit-attacker-mints-14-9b-unbacked-tokens-on-base-network/","credibility":2,"archive_timestamp":"2026-08-26T13:16:23+00:00"},{"url":"https://cryptobriefing.com/sandbox-halts-bridging-sand-exploit/","name":"CryptoBriefing: Sandbox halts Base and BNB Chain bridging after exploit mints billions of unbacked SAND tokens","type":"news_article","archive_url":"http://web.archive.org/web/20260824135603/https://cryptobriefing.com/sandbox-halts-bridging-sand-exploit/","credibility":2,"archive_timestamp":"2026-08-24T13:56:03+00:00"},{"url":"https://cryptobriefing.com/sandbox-security-breach-500m-sand-minted/","name":"CryptoBriefing: The Sandbox security breach","type":"news_article","archive_url":"https://web.archive.org/web/20260826022512/https://cryptobriefing.com/sandbox-security-breach-500m-sand-minted/","credibility":2,"archive_timestamp":"2026-08-26T02:25:12+00:00"},{"url":"https://castlecrypto.gg/news/the-sandbox-isolates-cross-chain-bridge-vulnerability-on-base-and-bsc/","name":"Castle Crypto: The Sandbox Isolates Cross Chain Bridge Vulnerability on Base and BSC","type":"news_article","archive_url":"http://web.archive.org/web/20260918235101/https://castlecrypto.gg/news/the-sandbox-isolates-cross-chain-bridge-vulnerability-on-base-and-bsc/","credibility":2,"archive_timestamp":"2026-09-18T23:51:01+00:00"},{"url":"https://beincrypto.com/sandbox-sand-bridge-exploit-base-bsc/","name":"BeInCrypto: The Sandbox Contains Bridge Exploit After Unbacked SAND Minted on Base and BSC","type":"news_article","archive_url":"http://web.archive.org/web/20260825004540/https://beincrypto.com/sandbox-sand-bridge-exploit-base-bsc/","credibility":2,"archive_timestamp":"2026-08-25T00:45:40+00:00"},{"url":"https://cryptonews.net/news/security/33334239/","name":"CryptoNews.net: Upbit Warns, Bithumb Suspends SAND After 500M+ Token Mint Exploit on Base","type":"news_article","archive_url":"https://web.archive.org/web/20260827134146/https://cryptonews.net/news/security/33334239/","credibility":2,"archive_timestamp":"2026-08-27T13:41:46+00:00"},{"url":"https://cryptorank.io/news/feed/a9298-coinbase-delist-perpetual-futures-sand","name":"CryptoRank: Coinbase to Delist 10 Perpetual Futures Including SAND on Aug. 26","type":"news_article","archive_url":"http://web.archive.org/web/20260824160252/https://cryptorank.io/news/feed/a9298-coinbase-delist-perpetual-futures-sand","credibility":2,"archive_timestamp":"2026-08-24T16:02:52+00:00"},{"url":"https://news.bitcoin.com/security/sandbox-sand-bridge-exploit-unbacked-tokens/","name":"Bitcoin.com News: Sandbox Bridge Hack Mints 14.9B SAND While Coinbase Delists Futures","type":"news_article","archive_url":"http://web.archive.org/web/20260824160239/https://news.bitcoin.com/security/sandbox-sand-bridge-exploit-unbacked-tokens/","credibility":2,"archive_timestamp":"2026-08-24T16:02:39+00:00"},{"url":"https://www.crowdfundinsider.com/2026/08/300900-the-sandbox-reports-security-incident-impacting-cross-chain-bridging-infrastructure/","name":"Crowdfund Insider: The Sandbox Reports Security Incident Impacting Cross-Chain Bridging Infrastructure","type":"news_article","archive_url":"http://web.archive.org/web/20260824225917/https://www.crowdfundinsider.com/2026/08/300900-the-sandbox-reports-security-incident-impacting-cross-chain-bridging-infrastructure/","credibility":2,"archive_timestamp":"2026-08-24T22:59:17+00:00"},{"url":"https://cryptoticker.io/en/sandbox-sand-bridge-exploit-base-bnb-chain/","name":"CryptoTicker: SAND Bridge Exploit: Base and BNB Chain Isolated","type":"news_article","archive_url":"https://web.archive.org/web/20260827134428/https://cryptoticker.io/en/sandbox-sand-bridge-exploit-base-bnb-chain/","credibility":2,"archive_timestamp":"2026-08-27T13:44:28+00:00"},{"url":"https://unchainedcrypto.com/kelp-dao-claims-layerzero-approved-the-setup-it-blamed-for-292-million-hack-migrates-to-chainlink/","name":"Unchained: Kelp DAO claims LayerZero approved setup blamed for $292M hack, migrates to Chainlink","type":"news_article","archive_url":"http://web.archive.org/web/20260509090304/https://unchainedcrypto.com/kelp-dao-claims-layerzero-approved-the-setup-it-blamed-for-292-million-hack-migrates-to-chainlink/","credibility":2,"archive_timestamp":"2026-05-09T09:03:04+00:00"},{"url":"https://www.theblock.co/post/400131/kelp-dao-ditches-layerzero-chainlink-cross-chain-infrastructure-292-million-exploit","name":"The Block: Kelp DAO ditches LayerZero for Chainlink after $292M exploit","type":"news_article","archive_url":"http://web.archive.org/web/20260506080536/https://www.theblock.co/post/400131/kelp-dao-ditches-layerzero-chainlink-cross-chain-infrastructure-292-million-exploit","credibility":1,"archive_timestamp":"2026-05-06T08:05:36+00:00"},{"url":"https://cryptobriefing.com/stake-dao-exploit-vsdcrv-arbitrum/","name":"CryptoBriefing: Stake DAO exploit: attacker mints 5.4T vsdCRV on Arbitrum","type":"news_article","archive_url":"http://web.archive.org/web/20260809030329/https://cryptobriefing.com/stake-dao-exploit-vsdcrv-arbitrum/","credibility":2,"archive_timestamp":"2026-08-09T03:03:29+00:00"},{"url":"https://www.cryptotimes.io/2026/05/27/stake-dao-exploited-as-hacker-mints-5-4-trillion-fake-vsdcrv/","name":"CryptoTimes: Stake DAO exploited as hacker mints 5.4 trillion fake vsdCRV","type":"news_article","archive_url":"http://web.archive.org/web/20260809055839/https://www.cryptotimes.io/2026/05/27/stake-dao-exploited-as-hacker-mints-5-4-trillion-fake-vsdcrv/","credibility":2,"archive_timestamp":"2026-08-09T05:58:39+00:00"},{"url":"https://en.cryptonomist.ch/2026/08/20/layerzero-crypto-migration-shift/","name":"CryptoNomist: LayerZero crypto migration hits $15B as BitGo, Wyoming exit to Chainlink","type":"news_article","archive_url":"http://web.archive.org/web/20260826064326/https://en.cryptonomist.ch/2026/08/20/layerzero-crypto-migration-shift/","credibility":2,"archive_timestamp":"2026-08-26T06:43:26+00:00"},{"url":"https://crypto.news/layerzero-chainlink-exodus-15-billion-bridge-migration/","name":"Crypto.news: $15B exodus: why crypto is leaving LayerZero for Chainlink","type":"news_article","archive_url":"http://web.archive.org/web/20260824135302/https://crypto.news/layerzero-chainlink-exodus-15-billion-bridge-migration/","credibility":2,"archive_timestamp":"2026-08-24T13:53:02+00:00"},{"url":"https://news.bitcoin.com/kelpdao-slams-layerzero-after-300m-exploit-shifts-rseth-to-chainlink-ccip/","name":"Bitcoin.com: KelpDAO slams LayerZero after $300M exploit, shifts rsETH to Chainlink CCIP","type":"news_article","archive_url":"http://web.archive.org/web/20260507042312/https://news.bitcoin.com/kelpdao-slams-layerzero-after-300m-exploit-shifts-rseth-to-chainlink-ccip/","credibility":2,"archive_timestamp":"2026-05-07T04:23:12+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-08-30T12:10:08.036529+00:00","updated_at":"2026-10-02T06:15:25.783944+00:00"},"source_quality":{"total":38,"tier1":0,"tier2":3,"tier3":2,"unrated":33},"follower_count":null,"content_updated_at":"2026-10-02T05:28:03.684Z","last_fact_checked_at":"2026-09-02T00:41:27.329Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}