The Sandbox is grappling with a suspected infinite mint exploit on Base, where an unauthorized address acquired minting privileges and produced billions of SAND — a quantity far exceeding the token's intended supply.

The mint ballooned rapidly during early trading on August 22. Initial on-chain tracking captured more than 500 million newly created tokens before PeckShield reported that 14.9 billion SAND had been minted across two addresses: 0xAbE0...4D22 and 0x638C...F296.

SAND normally has a total supply of 3 billion tokens, which puts the freshly minted Base-side balance at almost five times the established supply. The activity was detected on the Base deployment of SAND rather than the Ethereum mainnet token.

Attacker Gains SAND Minting Authority

The attack hinges on unauthorized minting permissions. An address beginning 0x6762...257e obtained authority over the Base SAND contract and began creating tokens without the normal supply constraint. How that authority was acquired has not been made public.

The newly created tokens must still reach usable liquidity or bridge infrastructure before their nominal value can translate into a corresponding market loss, which is why observers are watching transfers, bridge activity, and any exchange-side response rather than treating the minted amount as immediately realized damage.

At the latest check, SAND was trading near $0.047 on CoinMarketCap, up roughly 12% over 24 hours even as the abnormal minting activity unfolded. At that market price, 14.9 billion tokens would carry a nominal value near $700 million, although that figure does not represent confirmed stolen funds or realizable liquidity.

The incident closely follows the Harmony exploit, in which roughly 4 billion ONE were created without authorization. Harmony moved to coordinate exchange freezes while developers prepared a patch and considered a rollback, after much of the new supply moved toward centralized exchanges.

Unauthorized Token Mints Hit Multiple Projects

The Sandbox is now the latest project this summer to confront compromised token-supply controls. WEMIX previously suffered a separate contract ownership breach that enabled 5.23 million WEMIX$ to be minted, with the newly created assets subsequently moved across multiple networks.

Although the mechanics differ across the three cases, each placed control of token issuance directly at the center of the attack. For The Sandbox, the immediate focus is the Base contract and whether the unauthorized supply can move into bridges, decentralized exchanges, or other venues with usable liquidity.

The two addresses identified in the latest tracing held a combined 14.9 billion newly minted SAND as the Base contract activity continued to be investigated.

This report was first published by Crypto Adventure.