The Sandbox has suffered a major security breach in which attackers reportedly minted 49 billion unbacked SAND tokens, compromising the project's entire SAND liquidity across BNB Smart Chain (BSC) and Base. According to information shared on X by @coinbureau, The Sandbox team has confirmed the exploit and moved to isolate SAND liquidity on both networks. The project has also disabled bridging to and from BSC and Base while it assesses the incident.

The Sandbox is preparing a compensation plan for affected liquidity providers and has urged users not to interact with SAND on BSC or Base until further notice. The incident represents a significant security event for the SAND token and has prompted the project to restrict activity across two blockchain networks while it works to contain the impact.

The Sandbox is a blockchain-based virtual world operated by Animoca Brands in which users buy, develop, and monetize parcels of digital land known as LAND; SAND is the platform's native token, used for in-game transactions, staking, and governance participation. The token was issued with a maximum supply of 3 billion, a figure that places the reported 49 billion unauthorized mint at more than sixteen times the token's entire intended supply.

Attackers Mint 49 Billion Unbacked SAND

The reported exploit involved the creation of 49 billion SAND tokens that were not backed by corresponding assets. Minting refers to the creation of new cryptocurrency tokens according to the rules established by a token's underlying smart contract or blockchain infrastructure. In a properly controlled system, token issuance is governed by predefined mechanisms designed to prevent unauthorized creation. The reported attack appears to have bypassed those controls, allowing the attackers to create a substantial quantity of SAND.

The information shared by @coinbureau does not provide additional details about the specific vulnerability used in the attack, nor does it identify the individuals responsible for the exploit. The reported scale of the unauthorized minting, however, prompted The Sandbox team to take immediate measures to restrict SAND activity across the affected networks.

The Sandbox Confirms the Exploit

The Sandbox team has confirmed that an exploit occurred and has begun containment measures. One of the main actions was isolating SAND liquidity on BSC and Base. The project also disabled bridging to and from both networks.

Bridges are blockchain infrastructure that allows assets or information to move between different networks. Disabling those connections can help prevent an incident on one network from spreading through cross-chain transfers to another. By restricting bridging involving BSC and Base, The Sandbox is limiting the movement of SAND while it investigates the breach and determines the appropriate response. The project has also advised users to avoid interacting with SAND on the two affected networks until further notice.

Liquidity Providers Face Potential Impact

The security breach has also affected liquidity providers, commonly referred to as LPs. Liquidity providers supply assets to decentralized trading pools, allowing users to trade tokens without relying on a traditional centralized order book. In return, liquidity providers can receive fees or other incentives depending on the protocol.

The Sandbox is preparing a compensation plan for affected LPs following the reported exploit. The available information does not specify the size of the compensation pool, the eligibility requirements, or how compensation will be distributed. Those details are expected to be important for liquidity providers attempting to determine how the incident could affect their positions. Until additional information is released, users are being advised to follow the project's instructions and avoid interacting with SAND on BSC and Base.

Bridging Restrictions Affect BSC and Base

The decision to disable bridging in both directions between the affected networks represents another significant part of The Sandbox's response. Cross-chain bridges can provide important functionality by allowing users to move assets between blockchain ecosystems. At the same time, they can become an important consideration during a security incident, because unauthorized or compromised assets may otherwise be transferred between networks.

By disabling bridges connected to BSC and Base, The Sandbox is attempting to restrict further movement of SAND through those channels. The measure also means users may temporarily lose access to normal cross-chain functionality involving SAND on the affected networks. The project has not indicated in the information provided when bridging services will be restored.

Cross-chain infrastructure has also featured in several of the largest security incidents in the industry's history, including the Ronin Network breach in March 2022, which led to losses of over $600 million, and the Wormhole bridge exploit in February 2022, which involved roughly $320 million. The Sandbox has not disclosed whether its own bridge infrastructure played a role in the current incident, and the information released so far does not establish how the unauthorized minting was carried out. The historical record nonetheless illustrates why bridges and token issuance controls are treated as critical security surfaces by projects operating across multiple networks.

Users Urged to Avoid SAND on BSC and Base

The Sandbox has issued a direct warning to users concerning SAND activity on BSC and Base. Users have been urged not to interact with SAND on either network until further notice. That warning is particularly relevant following the reported minting of 49 billion unbacked tokens, as transactions involving an affected token during an active security incident can expose users to additional risks, particularly while the project's team is still investigating the underlying exploit.

The restriction applies specifically to SAND on BSC and Base, based on the information released by the project. Users should therefore pay close attention to official updates before attempting to trade, transfer, or otherwise interact with SAND on those networks.

Compensation Plan Still Under Preparation

The Sandbox is preparing a compensation plan for liquidity providers affected by the incident. The plan is intended to address the impact experienced by LPs following the reported security breach, although specific details have not yet been provided. The lack of information about the compensation mechanism means affected users will need to wait for additional guidance from the project.

The incident also highlights the importance of security controls surrounding token issuance and cross-chain infrastructure. A vulnerability that allows unauthorized token creation can have consequences beyond the initial blockchain where the exploit occurs, particularly when liquidity and bridges connect multiple networks.

For now, The Sandbox's response is focused on containment. The team has confirmed the exploit, isolated SAND liquidity on BSC and Base, disabled bridging to and from both networks, and begun preparing compensation for affected LPs. The project has also asked users to avoid interacting with SAND on the affected networks until further notice. The open questions that will shape what comes next include the size and eligibility criteria of the compensation plan, the timeline for restoring bridging services, and the findings of the investigation into how the unauthorized minting occurred. The reported breach involving 49 billion unbacked SAND remains an active security incident, and further information from official channels will be needed to determine the full impact and the next steps for affected users and liquidity providers.