The Sandbox Halts Bridges After 14.9B SAND Mint

Sandbox Bridge Exploit Mints 14.9 Billion SAND

The incident centered on the cross-chain version of SAND used on Base and BNB Smart Chain. A bridge normally keeps destination-chain tokens backed by an equivalent amount locked or accounted for on the source chain. The project said the attacker instead minted SAND without that backing.

In its public alert, Blockaid said the attacker hijacked LayerZero delegate permissions through an approveAndCall path. That is a preliminary technical account, not a final post-mortem from The Sandbox or LayerZero. The project has not yet identified the attacker or described the complete root cause.

PeckShield’s alert account reported 14.9 billion SAND minted across two addresses, roughly five times SAND’s 3 billion maximum supply on Ethereum. That count shows the scale of the unauthorized creation on the affected deployments, but does not mean five times the legitimate supply entered the normal market.

The Sandbox’s own statement used a very different measurement, calling the impact less than 0.01% of total SAND supply. It did not define whether that meant unrecovered liquidity, user balances, net reserve movement or another measure, and it did not reconcile the claim with the large public mint totals. Until a technical report gives that reconciliation, the two figures should not be treated as interchangeable.

The response also creates a practical split between chain infrastructure and the token contract. Base itself did not halt, just as a prior Base invalid-block incident did not mean every application on the network was affected. Here, the immediate restriction is on The Sandbox’s SAND bridge and liquidity on its Base and BNB Smart Chain deployments.

Face Value Is Not a $49 Billion Theft

The $49 billion headline needs careful handling. It is a face-value estimate from Blockaid, calculated as if all newly created unbacked SAND could be valued at the market price of legitimate SAND. A token balance can display that notional value on a tracker even when it has no one-for-one collateral, no credible exit liquidity and no ability to redeem through the isolated bridge.

The dedicated loss-impact check found three more useful numbers. PeckShield’s reported 14.9 billion SAND mint total measures unauthorized creation. Blockaid’s more than 400 transactions measures the observed attack activity. The approximately 14.75 million SAND, or about $675,000, reserve outflow reported by independent on-chain observers is the closest public estimate of assets actually removed, but remains unconfirmed by The Sandbox.

That is the figure users and liquidity providers need the project to address in its post-mortem. The Sandbox has not disclosed victim counts, an affected-wallet count, a final reimbursement amount, transaction hashes tied to compensation, or whether all apparent reserve outflows can be recovered.

The pattern is familiar in bridge incidents: a technical mint can create an alarming nominal supply number, while the financial harm depends on collateral access, market sales and who held affected liquidity. In the Verus bridge repeat exploit, the loss discussion was more direct because reported assets left the bridge. The Sandbox case is more complicated because the public evidence mixes isolated unbacked supply with a much smaller claimed reserve outflow.

Base and BNB Users Face a Bridge Freeze

The Sandbox said bridging on Base and BNB Smart Chain is disabled and that affected SAND is isolated, meaning holders should not expect normal transfers, redemption or price parity on those deployments. Its warning not to trade there applies especially to liquidity-pool users, whose balances can be exposed to the unbacked supply even if their personal wallet was not compromised.

The project said it had taken a pre-incident snapshot and was working on a compensation plan for eligible liquidity providers. It did not give a timeline, eligibility rule or token amount. Exchange restrictions are separate decisions, though some venues may pause deposits or withdrawals while they assess contract risk.

The next evidence to watch is a full technical report, a contract-level explanation of the delegate-permission path, the addresses and value of any confirmed reserve withdrawals, and a detailed compensation plan. Users with SAND on Ethereum or Polygon should still verify their network before interacting with any bridge link, while Base and BNB Smart Chain holders should follow The Sandbox’s instruction to avoid trading until the project announces a safe resolution.

The broader crypto market remained risk-on despite the isolated incident. Alternative.me’s Crypto Fear and Greed Index read 71, or Greed, in its latest update.

The most defensible current account is that The Sandbox contained a bridge exploit after massive unbacked SAND minting, while the verified economic damage remains unresolved. The $49 billion face-value claim is not a loss total, and the roughly $675,000 reserve-outflow estimate needs confirmation from the project and a complete on-chain reconciliation.