The Sandbox Bridge (2026) — Crypto Hack
Partially RecoveredAttacker hijacked LayerZero delegate permissions via the approveAndCall function on SAND's omnichain fungible token contract, minted unbacked SAND on Base and BNB Chain, and drained ~14.7M SAND from the Ethereum vault.
Summary
Attacker hijacked LayerZero delegate permissions via the approveAndCall function on SAND's omnichain fungible token contract, minted unbacked SAND on Base and BNB Chain, and drained ~14.7M SAND from the Ethereum vault.
How It Was Compromised — Bridge via Bridge Minting Flaw / Privilege Escalation (LayerZero OFT approveAndCall)
On August 21-22, 2026, an attacker exploited the approveAndCall convenience function on The Sandbox's SAND OFT contract on Base to hijack LayerZero delegate permissions, minting unbacked SAND on Base and BNB Smart Chain (Blockaid counted ~$49B face value across 400+ transactions; PeckShield counted 14.9B SAND to two addresses). The attacker then burned unbacked SAND to trigger reverse bridge transactions that released ~14.7M real SAND from the Ethereum vault (just 100 SAND short of the vault's balance). The Sandbox disabled bridging to and from Base and BNB Chain, isolated the affected tokens, and planned 1:1 compensation from its treasury for affected liquidity providers. Upbit and Bithumb suspended SAND deposits/withdrawals; Coinbase delisted SAND perpetual futures. No user wallets were compromised.
Fund Flow & Laundering Analysis
Some unbacked SAND was sold for ETH through a liquidity pool; the attacker's ~14.1M SAND extraction converted to roughly 80 ETH (~$675K-$987K). Attacker addresses were flagged with SEAL, TRM and Chainalysis.