TLDR
- An attacker exploited The Sandbox’s Base network contract, minting roughly 14.9 billion unbacked SAND tokens
- Actual losses were around 14.75 million SAND drained from Ethereum, netting the attacker about $675,000 (80 ETH)
- The Sandbox halted bridging on Base and BNB Smart Chain to contain the damage
- South Korean exchanges Upbit and Bithumb suspended SAND deposits and withdrawals
- SAND on Ethereum and Polygon was not affected, and no user wallets were compromised
On August 22, 2026, an attacker gained arbitrary minting rights on The Sandbox’s SAND contract deployed on Base, a Layer Zero Omnichain Fungible Token configuration used for cross-chain token movement.
⚠️ALERT: Sandbox hit by a major security breach as attackers mint 49B of unbacked $SAND, compromising its ENTIRE liquidity across BSC and Base.
The team has confirmed the exploit and isolated SAND liquidity on BSC and Base, while disabling bridging to and from both networks.… pic.twitter.com/UdvHTm7wuu
— Coin Bureau (@coinbureau) August 22, 2026
Using an “approveAndCall” function, the attacker hijacked LayerZero delegate permissions. This allowed them to mint tokens on Base without any backing from the real, locked SAND held on Ethereum.
Blockchain security firm Blockaid flagged the exploit while it was happening. PeckShield separately confirmed that roughly 14.9 billion SAND tokens were minted across two addresses, a number that far exceeds the token’s entire 3 billion supply on Ethereum mainnet.
#PeckShieldAlert Seems like The @TheSandboxGame ($SAND) got exploited. 14.9B $SAND minted across 2 addresses: 0xAbE0…4D22 & 0x638C…F296 pic.twitter.com/a5Jgym87gR
— PeckShieldAlert (@PeckShieldAlert) August 22, 2026
The headline figure of $49 billion is based on applying SAND’s market price to those unbacked tokens. That number does not represent stolen funds. It far exceeds any available liquidity and cannot be realized.
The actual loss was smaller. BlockWatchdog reported that approximately 14.75 million SAND was drained from the Ethereum OFT Adapter in under a minute, with realized proceeds of around 80 ETH, worth roughly $675,000.
The Sandbox said the exploit affected less than 0.01% of SAND’s 3 billion token supply when measured directly.
How The Sandbox Responded
The project disabled bridging to and from Base and BNB Smart Chain, leaving tokens on those networks unable to move or be redeemed. The project’s multisig also zeroed the LayerZero peers for Ethereum and BNB Smart Chain, effectively isolating Base.
The team warned users not to buy, sell, or trade SAND on Base or BNB due to compromised liquidity. SAND on Ethereum and Polygon was confirmed unaffected. The SAND locked on Ethereum to back cross-chain tokens remained intact.
South Korean exchanges Upbit and Bithumb moved quickly. Upbit issued a trading caution and Bithumb suspended SAND deposits and withdrawals after on-chain alerts flagged the breach.
The Sandbox, an Animoca Brands subsidiary that raised $93 million in 2021, said it is taking a snapshot from before the incident and preparing compensation for qualifying users of affected liquidity pools.
A technical post-mortem is planned. At the time of writing, the team had not issued a full public statement on the root cause.
SAND dropped nearly 10% intraday following the incident but was down just 0.8% over the 24-hour period.
The exploit highlights a known structural risk in cross-chain token deployments. Minting tokens on a secondary chain does not create new supply on Ethereum, but unbacked tokens can still reach exchanges and pressure prices.
Traders should monitor Upbit and Bithumb for updates on trading resumption and watch for The Sandbox’s official recovery or burn plan.
