Web3 gaming project The Sandbox suffered a cross-chain bridge exploit affecting SAND on Base and BNB Smart Chain.
According to security firm PeckShield, the attacker minted 14.9 billion unbacked SAND across two wallet addresses. That translates to about $718M.
Another blockchain security firm, Blockaid, clarified that the issue involved The Sandbox’s SAND Omnichain Fungible Token on Base. The OFT is a LayerZero feature that allows projects to seamlessly move tokens across blockchains.
In this particular case, the attacker compromised the Base OFT and gained administrative permissions for minting SAND. Blockaid denied the blame leveled against LayerZero, maintaining that the issue was with the Base SAND minting system.
Sandbox team downplays the hack
However, the team cautioned users against dealing with the SAND token across the Base or BSC chains. As part of the mitigation efforts, the project said it disabled movement and redemption of SAND between Base/BSC and other networks.
Additionally, the affected liquidity providers (LPs) due to the illegal SAND mint will be compensated after further review.
Following the update, SAND price slipped 5%, partly erasing the over 30% gains seen this week amid broader market recovery.
Crypto hacks hit $1.6B
The Sandbox hack adds to the growing list of exploits and crypto losses this year. So far, nearly $400M has been lost to crypto exploits in the past 90 days. On a year-on-year (YoY) basis, this translates to $1.6B.
From hardware wallets such as ColdCard to payment providers like Triple-A, the exploits have been far-reaching. Part of the rising cases have been enabled by AI models with cyber offensive capabilities.
Now imagine how vulnerable the industry may be if quantum computers also become a threat in the next few years. It remains to be seen how seriously the security risks will be addressed amid the tokenization, stablecoin, and AI agents boom.
Final Summary
- Sandbox has reportedly been exploited for $718M after a hacker minted 14.9B SAND tokens
- The project team downplayed the impact, noting that the vulnerability was isolated on Base and BSC chains.
