On August 21-22, 2026, an attacker exploited The Sandbox's SAND cross-chain bridge on Base and BNB Smart Chain, minting 329.24 trillion unbacked SAND tokens across 703 events over five hours. Blockaid flagged the minting activity at a face value of approximately $49 billion. Actual extractable lo...
"Attackers hijacked LayerZero delegate permissions via approveAndCall and minted unbacked SAND." — Blockaid, Web3 Security Firm
On August 21-22, 2026, an attacker exploited The Sandbox's SAND cross-chain bridge on Base and BNB Smart Chain, minting 329.24 trillion unbacked SAND tokens across 703 events over five hours. Blockaid flagged the minting activity at a face value of approximately $49 billion. Actual extractable losses totaled roughly $665,000 — 14.75 million SAND and 79.74 ETH drained from the Ethereum OFT adapter.
The incident represents the latest in a pattern of cross-chain bridge exploits that have drained over $328.6 million from eight major incidents in 2026 alone, according to PeckShield. While The Sandbox contained the exploit within hours and estimates the impact at less than 0.01% of SAND's 3 billion token supply, the attack exposes persistent structural vulnerabilities in the Omnichain Fungible Token (OFT) standard and the delegation model underpinning cross-chain token infrastructure.
At 23:42:05 UTC on August 21, 2026, an attacker began minting unbacked SAND tokens on the Base network through a compromised LayerZero Omnichain Fungible Token (OFT) contract. The minting continued until 04:45:21 UTC on August 22 — a window of approximately five hours. During that time, 329.24 trillion SAND tokens were created across 703 separate minting events on Base.
At 05:09:19 UTC, 24 minutes after minting activity ceased, The Sandbox's multisig wallet severed the LayerZero peer connections for Base and BNB Smart Chain, cutting off the bridge pathway through which unbacked tokens could have been redeemed against collateral held on Ethereum.
The Sandbox issued a public statement confirming the breach: "The impact is minimal, representing less than 0.01% of the total SAND token supply." The project confirmed that Ethereum and Polygon remained unaffected, and no user wallets were compromised.
SAND held on Ethereum, which backs all legitimate cross-chain deployments, remained intact. The Sandbox stated: "All bridged SAND funds are backed by SAND locked on Ethereum, which remains entirely secure."
The attack targeted the approveAndCall function on the SAND OFT contract deployed on Base. This function, a legacy ERC-20 extension designed to combine token approval and contract interaction in a single transaction, was weaponized to route a crafted payload through the token contract into the LayerZero endpoint.
By doing so, the attacker's helper contract gained the effective standing of a LayerZero delegate — the role that governs who is authorized to mint new token units on a given chain. With delegate permissions hijacked, the attacker could mint SAND on Base without triggering the corresponding burn mechanism on Ethereum that normally ensures 1:1 backing.
The attack vector is distinct from the KelpDAO bridge exploit of April 2026, which targeted the observation layer of LayerZero's Decentralized Verifier Network (DVN) infrastructure. In that incident, attackers compromised RPC nodes that the LayerZero Labs DVN relied upon to verify cross-chain messages, exploiting a 1-of-1 DVN configuration to release 116,500 rsETH (~$292 million).
The SAND exploit, by contrast, operated at the application layer. The vulnerability resided in the interaction between SAND's approveAndCall implementation and the LayerZero OFT delegate model — not in LayerZero's core messaging protocol. This distinction matters: it suggests the root cause was either a misconfigured delegate pathway that allowed a low-privilege call to escalate into control, or a compromise of the deployer or delegate key itself.
The Sandbox has not yet released a comprehensive technical post-mortem. Until that report is published, the precise root cause — misconfiguration versus key compromise — remains unconfirmed.
The $49 billion figure cited across media reports represents the nominal face value of all minted tokens at SAND's pre-exploit price of approximately $0.045. This number, while technically accurate as a calculation, overstates the economic impact by several orders of magnitude.
The 329.24 trillion tokens minted on Base represented roughly 109,747 times SAND's entire 3 billion token maximum supply. These tokens existed only on Base and were unbacked — they carried the SAND ticker but had no corresponding collateral locked on Ethereum.
Actual financial extraction was constrained by three factors:
Liquidity limitations. On-chain liquidity pools on Base could not absorb trillions of SAND at any meaningful price. The attacker could only extract value by selling through existing pools or by redeeming tokens through the bridge before it was severed.
Bridge severance. The Sandbox removed LayerZero peer settings for Base and BNB Smart Chain, preventing unbacked tokens from being redeemed against the Ethereum adapter's reserves.
Time window. The five-hour exploitation window, while longer than ideal, limited the total amount the attacker could move through available liquidity.
According to on-chain analysis by BlockWatchdog, the attacker transferred 14,095,483.66 SAND to a single wallet and extracted approximately 79.74 ETH from token sales. Total confirmed losses: roughly $665,000. PeckShield's analysis corroborated the figure of 14.75 million SAND drained from the Ethereum adapter.
The gap between $49 billion in nominal minting and $665,000 in realized extraction illustrates a recurring pattern in cross-chain exploits: the theoretical exposure vastly exceeds the practical damage when unbacked tokens cannot access sufficient exit liquidity.
South Korean exchanges Bithumb and Upbit responded within hours. Bithumb suspended SAND deposits and withdrawals at 11:11 a.m. KST on August 22 (10:11 p.m. ET, August 21), citing "suspected security-problem circumstances." Upbit issued an investor warning over abnormal on-chain activity.
SAND's price response was counterintuitively positive. The token traded up 4.76% to $0.0476 following the incident, with trading volume increasing over 400%. The rally likely reflects a combination of short-covering, the market's assessment that actual losses were minimal, and the broader crypto market tailwind — Bitcoin rose above $77,000 the same week.
The Sandbox committed to compensating affected liquidity providers through a pre-incident snapshot mechanism. The compensation schedule has not been announced.
The SAND exploit adds to a growing ledger of cross-chain bridge failures in 2026. According to PeckShield, eight major bridge incidents through mid-May 2026 resulted in approximately $328.6 million in cumulative losses.
| Incident | Date | Amount | Vector | |---|---|---|---| | Kelp DAO (rsETH) | April 18, 2026 | $292M | DVN observation layer compromise | | Drift Protocol | April 2026 | $285M | Social engineering of protocol signers | | Various (6 others) | Feb–May 2026 | ~$51.6M | Mixed (key compromise, access control) | | SAND (The Sandbox) | Aug 22, 2026 | ~$665K | approveAndCall delegate hijack |
Cross-chain bridges accounted for $28.6 million of May 2026's approximately $70 million in total crypto exploit losses — a 42% share from a single protocol category. Total 2026 hack losses surpassed $750 million through mid-April, according to KuCoin's aggregated data.
The historical pattern is persistent. Chainalysis estimated $2 billion stolen across 13 bridge hacks in 2022, representing 69% of all crypto theft that year. The three largest single-incident losses remain the Ronin Bridge ($625 million, March 2022), the BNB Bridge ($568 million, October 2022), and the Wormhole exploit ($320 million, February 2022).
The 2026 data suggests that while individual exploit sizes have declined from the nine-figure peaks of 2022, the frequency of bridge attacks has not abated. Bridges remain the highest-value targets in decentralized finance due to their concentrated liquidity pools and the complexity of securing cross-chain message verification.
The SAND exploit raises questions that extend beyond a single project.
The OFT delegation model. LayerZero's OFT standard allows token issuers to designate delegates who can mint tokens on destination chains. The security of this model depends entirely on the integrity of the delegate configuration and key management. When an approveAndCall function can be used to escalate privileges to delegate status, the trust boundary is violated at the application layer — not the protocol layer. This creates a category of risk that protocol-level audits may not catch.
The approveAndCall surface area. The approveAndCall function is a legacy ERC-20 extension that predates modern token standards. Its presence in cross-chain token contracts creates an attack surface that combines approval mechanics with arbitrary contract calls. The SAND exploit demonstrates that this function can be weaponized to interact with bridge infrastructure in unintended ways. Projects deploying OFT contracts should audit the interaction between approveAndCall (and similar callback functions) and their delegate configuration.
Detection versus prevention. Blockaid flagged the minting activity across 400+ transactions, but the exploit ran for five hours before being contained. The 24-minute gap between the end of minting activity and the multisig response suggests that automated circuit breakers — rate limits on minting, anomaly-triggered pauses — were either absent or insufficiently configured. For a project with a $113 million market capitalization, this response window represents a meaningful operational gap.
The liquidity defense. The SAND exploit's low realized losses relative to its nominal exposure resulted partly from the limited liquidity available on Base for SAND trading. This is an accidental defense, not a designed one. A more liquid deployment on a chain with deeper SAND pools could have resulted in significantly higher extraction.
approveAndCall function.approveAndCall functions when deployed in cross-chain infrastructure.The SAND bridge exploit produced a $49 billion headline and a $665,000 loss. The gap between the two numbers tells a story about the current state of cross-chain security: bridges remain structurally vulnerable, but the economic damage from any single exploit is increasingly constrained by liquidity fragmentation and rapid containment measures.
The more concerning signal is the frequency. Nine major bridge exploits in 2026 through August, following eight through mid-May, suggests that the cross-chain attack surface is not shrinking. Each incident leverages a different vector — DVN compromise for KelpDAO, social engineering for Drift, delegate hijacking for SAND — which means no single fix addresses the category.
For projects deploying OFT contracts, the SAND exploit offers a specific lesson: audit the interaction between legacy callback functions like approveAndCall and bridge delegate permissions. For the broader ecosystem, the lesson is older and unchanged — cross-chain bridges concentrate value and complexity in ways that attract persistent, sophisticated attackers.
The Sandbox has pledged a comprehensive technical report. Until it is published, the precise mechanism of the delegate compromise — and whether it reflects a systemic risk in the OFT standard or a project-specific misconfiguration — remains an open question.