The Sandbox Contained Bridge Exploit That Created Unbacked SAND Tokens on Base and BSC

The Sandbox Stops Unauthorized SAND Token Creation on Two Blockchains

The Sandbox, a virtual-world game built on blockchain technology, announced it has identified and contained a security issue in its cross-chain bridge. This bridge allows the SAND token to move between different blockchains. The issue let an attacker create unbacked SAND tokens on Base and BNB Smart Chain (BSC). Unbacked tokens are new tokens created without real assets to support their value.

The company disabled the bridge to and from Base and BSC, isolating the unbacked tokens so they cannot be moved or exchanged. The Sandbox stated that no user wallets were compromised and that SAND tokens on Ethereum and Polygon blockchains remain unaffected. The company also said the SAND tokens locked on Ethereum, which back all bridged SAND, are fully intact.

Key Details of the Incident

• The vulnerability was in the SAND cross-chain bridge, which allows tokens to move between blockchains.
• An attacker exploited the bridge to create unbacked SAND tokens on Base and BNB Smart Chain.
• The Sandbox contained the issue and disabled bridging to and from the affected blockchains.
• No user wallets were compromised, and SAND on Ethereum and Polygon is safe.
• The impact is described as "less than 0.01% of total SAND supply."
• Two South Korean exchanges, Upbit and Bithumb, froze SAND transfers as a precaution.

How the Exploit Worked

Security firm Blockaid explained that the attacker took control of LayerZero delegate permissions. LayerZero is a technology that helps tokens move across different blockchains. The attacker used a function called approveAndCall on SAND’s omnichain fungible token (OFT) contract on Base. An OFT is a token designed to work across multiple blockchains, and the delegate role controls who can create new tokens on a given blockchain.

Blockaid reported that the attacker created about $49 billion worth of unbacked SAND across more than 400 transactions. Another security firm, PeckShield, counted 14.9 billion SAND tokens created across two addresses. These numbers are much larger than SAND’s total circulating supply of about 2.94 billion tokens, according to CoinGecko.

South Korean Exchanges Freeze SAND Transfers

Upbit, a major South Korean exchange, suspended SAND deposits and withdrawals on the Ethereum network at 10:12 p.m. ET on Friday. The exchange cited a potential security issue at The Sandbox and invoked South Korea’s Virtual Asset User Protection Act. Upbit said it would work closely with The Sandbox team and would reopen transfers once stability is confirmed. Ethereum is the blockchain The Sandbox said was not affected by the exploit.

Upbit later issued a trading caution, warning users about potential price swings. Bithumb, another South Korean exchange, also suspended SAND deposits and withdrawals at 10:11 p.m. ET on Friday, citing the same law and security concerns. Trading remains available on both exchanges during the suspension.

What Is Confirmed

• The Sandbox identified and contained a vulnerability in its cross-chain bridge.
• The exploit allowed the creation of unbacked SAND tokens on Base and BNB Smart Chain.
• The bridge to and from Base and BSC has been disabled, isolating the unbacked tokens.
• No user wallets were compromised, and SAND on Ethereum and Polygon is unaffected.
• Upbit and Bithumb suspended SAND deposits and withdrawals as a precaution.
• The Sandbox is preparing a compensation plan for affected users and will release a full incident report.

What Is Still Unclear

• The exact amount of unbacked SAND created is unclear. Security firms reported different numbers, and The Sandbox has not provided a dollar figure for the loss.
• The Sandbox described the impact as "less than 0.01% of total SAND supply," but it is unclear what this percentage refers to.
• Neither The Sandbox nor the exchanges have announced when SAND transfers will resume.

Why This Matters for Crypto Users

This incident highlights the risks of cross-chain bridges, which are tools that allow tokens to move between different blockchains. When these bridges have security flaws, attackers can create unbacked tokens, which can lead to price instability and losses for users. Exchanges freezing transfers is a common precaution to protect users until the issue is resolved.

The Sandbox’s response shows the importance of quick action to contain vulnerabilities and communicate with users and exchanges. The company’s plan to compensate affected users may help restore trust in the SAND token.

Sources

• The Defiant