The Sandbox (SAND OFT Exploit)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·4CDrvB…suwZSummary
On August 21-22, 2026, an attacker exploited a configuration flaw in The Sandbox's SAND omnichain fungible token (OFT) contract on Base, abusing the approveAndCall function to hijack LayerZero delegate permissions and mint 329.24 trillion unbacked SAND across 703 events over roughly five hours. Despite a headline face value of about $49 billion, realised losses were about 14.75 million SAND drained from the Ethereum OFT Adapter and sold for roughly 80 ETH (about $675,000). The Sandbox halted its Base and BNB Smart Chain bridges, retired the compromised contracts and on August 27, 2026 announced a 1:1 treasury-funded compensation plan based on pre-exploit snapshots; the incident was the third reported LayerZero OFT-related exploit of 2026.
Connected Entities
20 entities · 58 linked investigations- The Sandbox (SAND)→mentioned with→Ethereum(80%)
- The Sandbox (SAND)→mentioned with→Polygon(70%)
- The Sandbox (SAND)→mentioned with→Coinbase(65%)
- The Sandbox (SAND)→mentioned with→Chainlink(60%)
- The Sandbox (SAND)→mentioned with→Arbitrum(60%)
- Ethereum→mentioned with→Coinbase(60%)
- Ethereum→mentioned with→Bitcoin(60%)
- Stake DAO→mentioned with→Arbitrum(80%)
- Stake DAO→mentioned with→Kelp(60%)
- Stake DAO→mentioned with→Ethereum(80%)
- + 103 more
5 submissions awaiting moderator review.
Timeline(16 events)
March 2026
LayerZero Labs developer allegedly socially engineered by North Korea's Lazarus Group, reportedly harvesting session keys later linked to the KelpDAO exploit.
Unchained CryptoApril 2026
KelpDAO's rsETH LayerZero bridge exploited (reported as April 18); approximately 116,500 rsETH (~$292 million) drained. LayerZero blamed Kelp's single-verifier configuration; Kelp disputed this.
CoinDesk / The BlockMay 2026
Stake DAO's vsdCRV LayerZero v2 bridge exploited via a compromised deployer key (reported as May 27); about 5.4 trillion unbacked vsdCRV minted on Arbitrum and roughly 43.78 ETH (~$91,000) extracted. Bridge permanently closed.
CryptoBriefing / CryptoTimesAugust 2026
Announced LayerZero-to-Chainlink CCIP migrations reach about $15 billion, led by BitGo's $7.4 billion WBTC move (reported August 20, two days before the Sandbox incident).
CryptoNomistAugust 2026
Attack begins at approximately 23:42:05 UTC on August 21. Attacker abuses approveAndCall on SAND's OFT contract on Base to hijack LayerZero delegate permissions and begins minting unbacked SAND.
CryptoTimesAugust 2026
Ethereum OFT Adapter drained to near zero: approximately 14,769,723 SAND withdrawn and converted to roughly 79.74-80 ETH (~$675,000). One account places this at approximately 01:22:11 UTC on August 22; another says it occurred within the first minute of the attack.
CryptoTimesAugust 2026
Blockaid posts a real-time public alert on X citing about $49 billion face-value SAND minted across 400+ transactions; PeckShield separately reports 14.9 billion SAND minted to two attacker addresses.
Blockaid / PeckShield on XAugust 2026
Minting stops at approximately 04:45:21 UTC on August 22 after about five hours; 329.24 trillion unbacked SAND minted across 703 events.
CryptoTimesAugust 2026
The Sandbox multisig removes LayerZero peer settings at approximately 05:09:19 UTC on August 22, 24 minutes after minting stops. Base and BNB Smart Chain bridging disabled; Ethereum and Polygon SAND unaffected.
CryptoTimesAugust 2026
The Sandbox publicly confirms the breach, says impact is under 0.01% of total SAND supply and commits to LP compensation based on a pre-incident snapshot.
CoinPaprikaAugust 2026
Upbit and Bithumb suspend SAND deposits and withdrawals on August 22 (Bithumb at about 11:11 KST). SAND falls about 5.5-10% intraday.
CryptoNews.netAugust 2026
Upbit designates SAND an investment warning asset effective 15:00 KST on August 24 under Article 17 of the Virtual Asset User Protection Act; reports say Upbit and Bithumb are weighing spot delisting.
CryptoTimesAugust 2026
Coinbase delists SAND perpetual futures (effective August 26) in a batch of ten contracts; open positions auto-settled; spot SAND unaffected.
CryptoRankAugust 2026
The Sandbox announces (August 27) a 1:1 treasury-funded compensation plan using pre-exploit snapshots (Base block 50,283,176; BSC block 117,321,965); claims portal expected within two weeks.
CryptoTimesAugust 2026
Brinztech publishes (August 28) an incident report classifying the event as a critical configuration and permission flaw in the SAND OFT bridge infrastructure.
Brinztech Breach AlertsDecision Log
- slot 457472447 · hash E6S41kvG8Kok8kPGzRag7jJbmPzGSdS59BJyZ7KyxJYK
- slot 443562176 · hash HuzVpBgFWTwwiw9SmMSW79FjsFqtTCXNXctt9VxqSn7z
- slot 443562169 · hash 6nt542W1AkeyU84p5TR9xpoFumxUqD9e82pfaLBUPR2t
- slot 443527086 · hash BXSjvRdnpR4eVZSrK4gNv7HHuhu2iYPty9gzynwAQjDh
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 36 of 38 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 8/30/2026, 12:10:08 PM
last updated: 10/2/2026, 5:28:03 AM
7 viewsavoid.net — verified advice for a post-truth world