Sandbox Bridge Hack Mints 14.9B SAND While Coinbase Delists Futures

Key Takeaways

• Peckshield flagged roughly 14.9 billion unbacked SAND minted across two addresses on August 21.
• The Sandbox disabled Base and BSC bridging subsequently, shielding Ethereum and Polygon-based SAND holders.
• The Sandbox is preparing LP compensation as Coinbase plans to delist SAND futures on August 26.

Exploit Hits Base and BSC Bridges

Sandbox, the metaverse gaming platform behind the SAND token, contained a vulnerability affecting its cross-chain bridges on Base and BNB Smart Chain (BSC). An attacker exploited the bridges’ minting mechanism to create SAND tokens with no real backing on both networks. The Sandbox disabled bridging on Base and BSC as soon as the exploit was detected, cutting off the attacker’s ability to move the fabricated tokens further.

The Sandbox’s bridge infrastructure normally works by locking SAND on one chain, typically Ethereum, and minting an equivalent, fully backed amount on the destination network. That 1:1 backing model is what broke down in this incident, allowing tokens to be minted on Base and BSC without a matching lock on the source chain.

A 14.9 Billion Token Anomaly

Peckshield identified approximately 14.9 billion unbacked SAND minted across two addresses tied to the exploit. The scale of that figure stands out given SAND’s legitimate total supply is capped at 3 billion tokens, meaning the minted amount was nearly five times larger than every real SAND token that has ever existed or will exist.