The Sandbox Halts Base and BNB Bridging After LayerZero Permission Exploit

The Sandbox has disabled bridging for SAND tokens on the Base and BNB Smart Chain networks following a security exploit that allowed an attacker to mint unbacked assets. The move aims to isolate the fraudulent tokens and prevent further systemic risk across the gaming network's ecosystem.

According to reports from CoinDesk, the attacker utilized an 'approveAndCall' function to hijack LayerZero delegate permissions. This vulnerability enabled the unauthorized minting of SAND tokens on the affected networks. Security firm PeckShield identified approximately 14.9 billion SAND minted across two separate addresses. While the nominal face value of these unbacked tokens was estimated by Blockaid at roughly $49 billion, this figure is a theoretical calculation based on market price and does not represent actual stolen funds or available liquidity.

Technical Context

The Sandbox operates as a decentralized metaverse and blockchain gaming network where the SAND token serves as the primary utility asset. This specific incident targeted the bridged versions of the token—assets that represent SAND held on another chain. While the Base and BNB Smart Chain bridges were compromised, the primary token supplies on Ethereum and Polygon remained unaffected. The exploit specifically targeted the trust relationship between the network and LayerZero, the cross-chain messaging protocol used to facilitate these transfers.

Market Implications

This event underscores the persistent vulnerabilities inherent in cross-chain bridging and the risks associated with delegate permissions. Although the protocol's direct financial loss is limited because the tokens were unbacked, the market reaction was immediate. Major South Korean exchanges, including Upbit, took precautionary measures and issued warnings regarding SAND, demonstrating how quickly bridged asset exploits can trigger volatility and liquidity freezes in centralized trading environments.

Next Steps

Bridging to and from the affected networks remains disabled as the team works to resolve the permission flaw. Market participants are monitoring whether the unbacked tokens can be successfully burned or neutralized without impacting legitimate holders. It remains to be seen if further audits of LayerZero integrations across other metaverse assets will reveal similar vulnerabilities.