Overview
- On Saturday, on-chain monitors flagged massive unbacked SAND balances on Base and BNB Smart Chain and The Sandbox immediately disabled bridging to those networks and warned users not to trade or provide liquidity there.
- Forensics show the attacker minted tokens on destination chains without matching Ethereum backing and withdrew about 14.75 million legitimately backed SAND from the Ethereum adapter, converting roughly 80 ETH (about $675,000) before the bridge was cut.
- Security firms including Blockaid attribute the incident to takeover or abuse of LayerZero delegate permissions via an approveAndCall path, a configuration failure that let the attacker mint tokens in the Omnichain Fungible Token model.
- The inflated on‑chain totals that produced headlines like roughly $49 billion were price‑weighted token balances on explorers and do not reflect actual collateral or withdrawable value held by the attacker.
- The Sandbox is taking a pre‑attack snapshot and says it will compensate eligible liquidity providers but has not yet published a detailed methodology, a final loss accounting, or a timetable for reopening the isolated bridges.