Web3 gaming network Sandbox stops Base and BNB chain bridging after exploit

The Sandbox disabled bridging on affected networks to isolate tokens and warned users not to trade SAND on Base and BNB, citing an impact of under 0.01% of supply.

An Attacker used an approveAndCall function to mint unbacked SAND on Base and BNB, with Blockaid estimating a nominal face value of roughly $49 billion.

The Sandbox disabled bridging on affected networks to isolate tokens and warned users not to trade SAND on Base and BNB, citing an impact of under 0.01% of supply.

Major South Korean exchanges Bithumb and Upbit have suspended SAND deposits and withdrawals following the security incident.

Sandbox, the metaverse and blockchain gaming network, halted Base and BNB Smart Chain bridging after discovering an exploit that allowed an attacker to mint unbacked tokens on those networks.

The attackers used that exploit to bridge as much as $49 billion in unbacked tokens. However, that figure does not represent money stolen or available to the attacker. It applies the SAND token’s market price to tokens created without backing, far exceeding the liquidity available to sell them.

SAND itself has a market capitalization of roughly $136 million.

The company did not define “impact” or reconcile the figure, but said the exploit represented less than 0.01% of SAND’s 3 billion token supply, equivalent to fewer than 300,000 SAND when measured directly against the supply.

Blockchain security firm Blockaid flagged the exploit while it was underway, saying the attacker had hijacked LayerZero delegate permissions through an “approveAndCall” function and minted unbacked SAND tokens.

While the exploit didn’t siphon out billions in tokens, it put the face value of the tokens created at roughly $49 billion across more than 400 transactions.

PeckShield separately identified 14.9 billion SAND minted across two addresses. The different figures were reported at separate stages of the incident and measure nominal token creation rather than confirmed losses.

The Sandbox disabled bridging to and from Base and BNB Smart Chain, leaving SAND on the two networks unable to be moved or redeemed. It warned users not to buy, sell or trade the token there because liquidity had been compromised.

SAND token on Ethereum and Polygon was unaffected, the company said. No user wallets were compromised, and the SAND locked on Ethereum to back-bridge tokens remains intact.

South Korean exchanges Bithumb and Upbit , meanwhile, suspended SAND deposits and withdrawals after citing suspected security issues.

The network said that it is taking a snapshot from before the incident and preparing compensation for qualifying users of the affected liquidity pools. It said it would publish a technical post-mortem later.

SAND is down just 0.8% in the last 24-hour period, but saw a near 10% intraday plunge after the incident was unveiled.

1 Crypto’s next billion users might be AI agents, and they’re paying with stablecoins now

2 Tokenized stocks risk repeating Wall Street’s 1960s ‘paper crisis,’ Fairmint CEO says 19 min ago

3 Kalshi off-limits in multiple states as prediction markets, CFTC team up for battle 49 min ago

4 Bitcoin and Ether bears get decimated amid 'squeeze-led' rally and Musk's X wants to pay creators in stablecoins: Crypto's week in 5 stories 2 hrs ago

5 Zcash jumps 48% to over $800 as Grayscale spot ETF push adds to ‘next bitcoin’ buzz 8 hrs ago

6 How a Treasury buyback tweak helped bitcoin surge 25% to nearly $80,000 in days 9 hrs ago

7 Crypto advocates join in suing Illinois over digital asset tax 16 hrs ago

8 Pass the Clarity Act 19 hrs ago

9 Ethena's ENA token surges 48%, but altcoin season will have to wait 22 hrs ago

10 Coldcard ships firmware after $114 million bitcoin theft; says AI helped catch more bugs 1 day ago

Anvil: The Missing Collateral Layer

Anvil: The Missing Collateral Layer

Anvil is a shared on-chain collateral layer built on a programmable letter of credit: reserve assets as a guarantee -no loan, no interest, keep custody & yield.

Anvil is a shared on-chain collateral layer built on a programmable letter of credit: reserve assets as a guarantee -no loan, no interest, keep custody & yield.

Why it matters :