Skip to main content
Sign in

The Sandbox SAND Bridge Exploit

avoid.net/the-sandbox-sand-bridge-exploit→38/100·82% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

Summary

On August 21-22, 2026, an attacker exploited a vulnerability in The Sandbox's SAND omnichain fungible token (OFT) contract on Base and BNB Smart Chain, hijacking LayerZero delegate permissions via the approveAndCall function to mint 329.24 trillion unbacked SAND tokens across 703 transactions over approximately five hours. Although the notional face value of minted tokens was reported at approximately $49 billion, the attacker extracted an estimated $665,000-$675,000 in actual value (approximately 80 ETH) by draining the Ethereum OFT Adapter before The Sandbox halted bridging and severed LayerZero peer connections. The Sandbox characterized the direct supply impact as less than 0.01% of the 3 billion total SAND supply and stated it would compensate eligible liquidity providers using a pre-incident snapshot.

Connected Entities

1 entities
Organizations
□The Sandbox SAND Bridge Exploit
Relationships
    Have evidence about The Sandbox SAND Bridge Exploit?

    Timeline(9 events)

    2026-08-21

    Attack begins at approximately 23:42:05 UTC. Attacker exploits approveAndCall function on SAND OFT contract on Base, hijacking LayerZero delegate permissions and beginning unbacked token minting.

    CryptoTimes

    2026-08-22

    Attack ceases at approximately 04:45:21 UTC. By this point 329.24 trillion unbacked SAND have been minted across 703 transactions to 173 addresses. Approximately 80 ETH (~$675,000) has been extracted from the Ethereum OFT Adapter.

    CryptoTimes

    2026-08-22

    At approximately 05:09:19 UTC — 24 minutes after minting stops — The Sandbox multisig removes LayerZero peer settings for Base and BNB Smart Chain, severing cross-chain messaging.

    CryptoTimes

    2026-08-22

    Blockaid posts public alert on X flagging approximately $49 billion face-value SAND minted in an ongoing exploit. PeckShield separately reports 14.9 billion SAND minted across two attacker addresses.

    Blockaid / PeckShield via X

    2026-08-22

    The Sandbox discloses breach publicly and halts Base and BNB Smart Chain bridging. Issues official statement characterizing impact as less than 0.01% of total SAND supply. Announces LP compensation snapshot plan.

    CoinPaprika

    2026-08-22

    South Korean exchanges Bithumb (approximately 11:11 a.m. KST) and Upbit suspend SAND deposits and withdrawals citing the security incident.

    CryptoNews.net

    2026-08-24

    Reports emerge that Upbit and Bithumb are evaluating potential spot delisting of SAND. No formal delisting decision announced.

    CryptoTimes

    2026-08-26

    Coinbase delists SAND perpetual futures contracts along with nine other tokens. Open positions auto-settled at average price from the final hour of trading. Spot SAND unaffected on Coinbase.

    CryptoRank

    2026-08-27

    As of this date, The Sandbox has not published a technical post-mortem, bridge restoration timeline, or LP compensation methodology. Base and BNB Smart Chain bridges remain suspended.

    crypto.news
    Provenance & Audit Trail
    13 Wayback Archives

    Decision Log

    • #1publish⛓ pending8/27/2026, 12:05:01 PM
      hash: 98YcGuGGxc7V8HJxvCweEUKj21jKTTJGaC2LtcwWuRAi

    13 of 16 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-sonnet-4-6

    generated: 8/27/2026, 12:04:48 PM

    last updated: 8/27/2026, 1:49:07 PM

    avoid.net — verified advice for a post-truth world