#SandboxSANDSuspectedInfiniteMintFlawOnBase
šØ ATTACKERS HAVE JUST CLOCKED 49 BILLION UNBACKED DOLLARS NOT LASTREADOS $SAND AND DRAINED ALL LIQUIDITY IN BSC AND ON THE BASE.
The Sandbox confirmed the exploit, isolated the pools, and cut the bridging. The offer of another token was rewritten publicly. Control was never absolute.
š WHAT HAPPENED:
Attackers hijacked LayerZero delegate permissions through an `approveAndCall` function in the SAND OFT contract on Base. This allowed them to mint unbacked tokens in industrial quantitiesāabout 14.9 billion SAND across two wallets.
š THE NUMBER THATāS IMPRESSIVE:
The āface valueā reached $49 billion, but the real loss was much smaller: approximately 14.75 million SAND were drained from the Ethereum adapter, resulting in about 80 ETH ($675,000).
ā ļø WHAT THE SANDBOX DID:
- Disabled bridging between Base and BSC
- Isolated the tokens on those networks ā they canāt be moved or withdrawn
- Took a pre-incident snapshot to compensate affected LPs
- Advised users NOT to buy, sell, or trade SAND on Base or BSC
š FOR THE MARKET:
SAND on Ethereum and Polygon was not affected, and no user wallet was compromised. The total supply on Ethereum remains 3 billion.
š” THE LESSON:
Bridge exploits remain the Achillesā heel of the ecosystem. What matters isnāt the face value ā itās what can truly be extracted.
$DOGE $ACE
šØ ATTACKERS HAVE JUST CLOCKED 49 BILLION UNBACKED DOLLARS NOT LASTREADOS $SAND AND DRAINED ALL LIQUIDITY IN BSC AND ON THE BASE.
The Sandbox confirmed the exploit, isolated the pools, and cut the bridging. The offer of another token was rewritten publicly. Control was never absolute.
š WHAT HAPPENED:
Attackers hijacked LayerZero delegate permissions through an `approveAndCall` function in the SAND OFT contract on Base. This allowed them to mint unbacked tokens in industrial quantitiesāabout 14.9 billion SAND across two wallets.
š THE NUMBER THATāS IMPRESSIVE:
The āface valueā reached $49 billion, but the real loss was much smaller: approximately 14.75 million SAND were drained from the Ethereum adapter, resulting in about 80 ETH ($675,000).
ā ļø WHAT THE SANDBOX DID:
- Disabled bridging between Base and BSC
- Isolated the tokens on those networks ā they canāt be moved or withdrawn
- Took a pre-incident snapshot to compensate affected LPs
- Advised users NOT to buy, sell, or trade SAND on Base or BSC
š FOR THE MARKET:
SAND on Ethereum and Polygon was not affected, and no user wallet was compromised. The total supply on Ethereum remains 3 billion.
š” THE LESSON:
Bridge exploits remain the Achillesā heel of the ecosystem. What matters isnāt the face value ā itās what can truly be extracted.
$DOGE $ACE