The Sandbox (SAND omnichain bridge) hack — August 2026

An attacker minted unbacked SAND on Base and BNB Smart Chain on 22 August 2026 after taking over the LayerZero delegate permissions on the token's omnichain contract through an approveAndCall function, which granted minting rights on those two chains without depositing anything on Ethereum.

The face value and the realised loss are far apart, and the distinction matters. Blockaid flagged close to $49bn of nominal SAND across more than 400 transactions and PeckShield counted 14.9bn unbacked tokens across two addresses, but nothing like that could be sold. The extraction that actually cleared was about $675,000: roughly 14.75m genuine SAND pulled from the Ethereum adapter and around 80 ETH realised from sales. The figure recorded here is the amount extracted, not the amount minted.

The Sandbox stopped bridging to Base and BNB Smart Chain, isolated the unauthorised tokens and said the SAND locked on Ethereum was untouched, putting the direct impact below 0.01% of the 3bn token supply. Ethereum and Polygon SAND were unaffected. The team said it would compensate eligible liquidity providers on their pre-attack balances; that had been announced but not completed at the time of recording. Upbit and Bithumb suspended SAND deposits and withdrawals. No official post-mortem confirming the delegate mechanism has been published.