Sandbox Bridge Hack Mints 14.9B SAND While Coinbase Delists Futures

Exploit Hits Base and BSC Bridges

Sandbox, the metaverse gaming level down the SAND token, contained a vulnerability affecting its cross-chain bridges connected Base and BNB Smart Chain (BSC). An attacker exploited the bridges’ minting mechanics to make SAND tokens with nary existent backing connected some networks. The Sandbox disabled bridging connected Base and BSC arsenic soon arsenic the exploit was detected, cutting disconnected the attacker’s quality to determination the fabricated tokens further.

The Sandbox’s span infrastructure usually works by locking SAND connected 1 chain, typically Ethereum, and minting an equivalent, afloat backed magnitude connected the destination network. That 1:1 backing exemplary is what broke down successful this incident, allowing tokens to beryllium minted connected Base and BSC without a matching fastener connected the root chain.

A 14.9 Billion Token Anomaly

Peckshield identified astir 14.9 cardinal unbacked SAND minted crossed 2 addresses tied to the exploit. The standard of that fig stands retired fixed SAND’s morganatic full proviso is capped astatine 3 cardinal tokens, meaning the minted magnitude was astir 5 times larger than each existent SAND token that has ever existed oregon volition exist.

The mismatch is communal successful span exploits, wherever an attacker manipulates a astute contract’s mint relation alternatively than really stealing locked collateral. Similar mint-based attacks person deed different protocols passim the year, including a span exploit that fto an attacker mint 1 cardinal unauthorized DOT tokens connected Polkadot’s span earlier successful 2026, and a smaller incidental wherever astir 13.76 cardinal unbacked ALPH tokens were created connected the Alephium bridge.

In each case, the fabricated tokens carried nary existent worth and could beryllium neutralized erstwhile the affected concatenation froze the exploited contract.

The Sandbox said the incidental affected little than 0.01% of SAND’s full proviso successful presumption of genuine backing astatine risk. SAND held connected Ethereum and Polygon, idiosyncratic wallets crossed the ecosystem, and the Ethereum-locked assets that backmost the token remained untouched passim the exploit, the institution said.

The level is present preparing a compensation program for eligible liquidity providers who held positions affected by the unbacked minting, and it has advised users not to commercialized SAND connected Base oregon BSC until the bridges are restored.

Part of a Bigger Bridge Security Problem

Bridge exploits person topped $320 cardinal successful losses crossed the crypto manufacture implicit the archetypal fractional of the year, arsenic attackers person progressively started targeting the astute contracts that link abstracted blockchains alternatively than idiosyncratic protocols. Bitcoin.com News has tracked a akin signifier successful caller months, including the Gravity Bridge exploit that saw a hacker drain $5.4 cardinal and way the funds done Binance earlier the way went cold.

Moreover, it bears mentioning that SAND was already facing unit autarkic of the exploit, with its token trading adjacent $0.039 arsenic of this week, and Coinbase announcing its plans to delist 10 perpetual futures contracts, including SAND, effectual August 26, arsenic portion of a broader reappraisal of trading measurement and liquidity crossed its derivatives markets.

Open positions volition beryllium settled automatically astatine that point, adding a 2nd root of near-term volatility connected apical of the span incident.

The adjacent measurement for The Sandbox is simply a post-mortem connected however the bridge’s minting controls failed and a information audit earlier Base and BSC bridging is switched backmost on.