The Sandbox Bridge Hack: An Attacker Prints $49 Billion in Phantom SAND
SAND, The Sandbox's metaverse token, has a hard cap of 3 billion. One attacker just minted several times that across two chains.
Three key facts
About $49 billion in paper tokens. On August 22, The Sandbox's SAND bridge on Base and BNB Smart Chain was exploited. According to security firm Blockaid, the attacker hijacked LayerZero delegate permissions through an approveAndCall function and minted unbacked SAND with a nominal value of about $49 billion across more than 400 transactions. PeckShield counted roughly 14.9 billion SAND, nearly five times the token's 3 billion maximum supply.
The project says real impact is under 0.01%. The Sandbox shut down bridging on Base and BSC, told users not to buy, sell or trade SAND on those two chains, and said SAND on Ethereum and Polygon was unaffected, no user wallets were compromised, and genuine backing at risk was less than 0.01% of total supply. It plans to snapshot pre-incident positions and compensate affected liquidity providers.
Korean exchanges hit the brakes. Upbit and Bithumb suspended SAND deposits and withdrawals. CoinDesk reported that SAND fell nearly 10% intraday after the disclosure but ended the 24-hour period down only about 0.8%.
WangDou's Take
$49 billion sounds terrifying, but it's worth about as much as Monopoly money: no liquidity, no way to cash out a cent. That's exactly the problem, though. A supposedly decentralized bridge handed over its minting rights through a single function call, and the only response available was to pull the plug. It's a bank whose vault key got copied, with the manager assuring everyone the thief can't carry anything out because the door has been welded shut. SAND dropped 10% and bounced right back, which tells you the market already prices the token about as seriously as metaverse real estate. Bridges have been crypto's biggest hole for years running. The industry says on-chain finance will replace Wall Street, yet it still can't lock up the printing press for its own tokens.
Source: CoinDesk · The Defiant · Bitcoin.com News