Home›Crypto›Market Structure›The Sandbox isolates SAND after cross-chain bridge exp…

The Sandbox isolates SAND after cross-chain bridge exploit

The studio switched off SAND bridging to Base and BNB Smart Chain and warned users not to trade the token on those networks due to compromised liquidity.

Reported · Written up by our desk · Market Structure

The Sandbox said it has identified and fully contained a vulnerability in the SAND cross-chain bridge that allowed an attacker to mint unbacked SAND on Base and BNB Smart Chain. The company said it has switched off bridging to and from both networks, leaving SAND on those chains isolated and unable to be moved or redeemed.

In a statement posted at 3:22 a.m. ET Saturday, The Sandbox told users not to buy, sell or trade SAND on Base or BSC, saying liquidity on those networks is compromised. It added that no user wallets were compromised, that SAND on Ethereum and Polygon is unaffected, and that the SAND locked on Ethereum backing all bridged SAND remains intact.

The studio said the impact is less than 0.01% of total SAND supply, while security firm Blockaid described how the attacker hijacked LayerZero delegate permissions using a function called approveAndCall on SAND's omnichain fungible token contract on Base. Blockaid said the attacker minted about $49 billion in face value SAND across more than 400 transactions as of 12:14 a.m. ET, and said the attack was still ongoing.

PeckShield, in an alert published at 1:40 a.m. ET, counted 14.9 billion SAND minted across two addresses, with block-explorer screenshots showing token credits from the null address dated Aug. 22. Separate South Korean exchange actions followed earlier, with Upbit suspending SAND deposits and withdrawals on Ethereum and freezing transfers under South Korea's user-protection provision for suspected security incidents.

Latest closeEthereum $2,426.15 ▼3.5%|BNB $697.76 ▲1.6%

More like this

Sources