An attacker weaponized a single ERC-20 function to hijack LayerZero delegate permissions and mint 329 trillion unbacked SAND on Base, yet the actual reserve drain totaled just $675,000, exposing both the fragility and the hidden safeguards of cross-chain token architecture.
Summary
- An attacker exploited the approveAndCall function on The Sandbox\u2019s SAND omnichain fungible token contract on Base, hijacking LayerZero delegate permissions and minting 329.24 trillion unbacked SAND across 703 events over five hours on Aug. 21 and 22, 2026.
- Blockchain security firm Blockaid flagged $49 billion in face-value SAND minted across more than 400 transactions, while PeckShield counted 14.9 billion SAND directed to two attacker-controlled addresses.
- The actual financial extraction was far smaller: roughly 14.75 million SAND drained from the Ethereum OFT Adapter in under 60 seconds, yielding approximately 80 ETH (around $675,000 at the time of the transactions).
- The Sandbox disabled bridging on Base and BNB Smart Chain, removed LayerZero peer settings via multisig, and confirmed that SAND on Ethereum and Polygon was unaffected; Korean exchanges Upbit and Bithumb halted deposits and withdrawals, and Coinbase delisted SAND futures.
- The incident marks the third major LayerZero-related bridge exploit in five months, following the $292 million Kelp DAO attack in April and the Stake DAO breach in May, accelerating a $15 billion migration wave from LayerZero to Chainlink CCIP.
On the night of Aug. 21, 2026, an address that had been dormant for 313 days routed a crafted payload through The Sandbox\u2019s SAND token contract on Base. Within five hours, blockchain explorers showed trillions of freshly minted SAND tokens spreading across 173 wallets. The face value, calculated by multiplying inflated balances against the live market price, briefly crossed $49 billion. That number exceeded the market capitalization of all but a handful of crypto projects. It also had almost no relationship to the money the attacker actually took.
The gap between the headline figure and the real extraction ($675,000, roughly the price of a modest house) reveals something important about how cross-chain token systems work and how they fail. It also reveals how crypto security reporting can amplify panic through numbers that are technically accurate but practically meaningless. Understanding why the attacker could mint a number larger than the gross domestic product of several small nations, yet walk away with a fraction of a fraction of that sum, requires examining the architecture that made the exploit possible and the constraints that limited its damage.
The Sandbox is one of the most recognizable names in Web3 gaming, with its SAND token powering a virtual world where users create, own, and monetize gaming experiences. The project was expanding its cross-chain presence to Base and BNB Smart Chain through LayerZero\u2019s OFT framework when the vulnerability was exploited. That expansion, intended to improve accessibility and reduce transaction costs for users, instead became the vector for the largest nominal-value bridge exploit in crypto history.
What happened on the night of Aug. 21
The first on-chain signal appeared at 23:42:05 UTC on Aug. 21. An externally owned account, later tagged by PeckShield as attacker-controlled address 0x638C, began submitting transactions to the SAND OFT contract deployed on Base. Each transaction invoked the approveAndCall function, a standard ERC-20 extension designed as a user-experience shortcut that combines a token approval and a follow-on contract call in a single transaction.
In this case, the follow-on call was anything but routine. The crafted payload routed through the token contract into the LayerZero endpoint, granting the attacker\u2019s helper contract the effective standing of a delegate with administrative rights over endpoint configuration. Once that delegate status was secured, the attacker could mint SAND on Base without any corresponding lock of tokens on the Ethereum side.
Over the next five hours, 703 distinct minting events distributed newly created SAND to 173 addresses. The minting stopped organically at 04:45:21 UTC on Aug. 22. Twenty-four minutes later, at 05:09:19 UTC, The Sandbox\u2019s multisig wallet zeroed out the trusted peer settings for Base and BNB Smart Chain, severing the cross-chain link that the attacker had exploited.
How approveAndCall became an attack vector
The approveAndCall function exists in many ERC-20 token implementations. It was originally conceived to solve a genuine usability problem: standard ERC-20 transfers require two separate transactions (approve, then transferFrom), costing users extra gas and extra time. By bundling both steps, approveAndCall lets a user approve a spender and trigger an action in a single transaction.
The vulnerability in the SAND implementation was not in the approval mechanism itself but in what the function allowed as the \u201ccall\u201d portion. When the SAND OFT contract on Base processed an approveAndCall transaction, it forwarded the embedded calldata to the target contract specified by the caller. If that target was the LayerZero endpoint, the call arrived with the token contract as the msg.sender, not the original external caller.
This distinction matters because LayerZero\u2019s endpoint checks permissions based on msg.sender. The SAND OFT contract held delegate authority over its own endpoint configuration. By routing through approveAndCall, the attacker effectively borrowed that authority. The result was a privilege escalation: an unauthorized external account gained the ability to reconfigure the endpoint and authorize arbitrary minting.
Security researchers from Blockaid described the root cause as \u201cthe takeover of LayerZero delegate permissions through an approveAndCall function.\u201d It was not a flaw in the LayerZero protocol itself but an application-level configuration failure in how The Sandbox\u2019s OFT contract interacted with the endpoint.
The $49 billion that never existed
The face-value figure that circulated in the hours after the exploit deserves careful scrutiny. Blockchain explorers calculate token values by multiplying balances against the last traded price. When an attacker mints 329.24 trillion SAND and the token trades at fractions of a cent, the resulting number is mathematically enormous but economically hollow.
SAND has a legitimate maximum supply of 3 billion tokens on Ethereum. The attacker\u2019s 329 trillion minted tokens exceeded that supply by a factor of roughly 110,000. No market on any exchange, centralized or decentralized, could absorb even a tiny fraction of that volume at the quoted price. The moment any significant sell pressure materialized, the price on affected venues would collapse toward zero.
The actual extraction followed a different, far more constrained path. Within the first 60 seconds of the exploit, 14.75 million SAND was withdrawn from the Ethereum OFT Adapter, the contract that holds locked SAND backing cross-chain transfers. That withdrawal happened across 15 transactions, with 14,095,483 SAND routed to a single externally owned account in six transactions over 24 seconds. The total proceeds converted to approximately 79.74 ETH, worth roughly $675,000.
The Sandbox put the impact at \u201cless than 0.01% of the total SAND token supply.\u201d While critics noted the percentage framing downplayed the absolute dollar figure, the math is straightforward: 14.75 million tokens divided by 3 billion equals 0.49% of supply, with the actual value extracted representing a small fraction of the project\u2019s market capitalization.
The bridge architecture that limited the damage
Understanding why the attacker could not convert trillions of phantom tokens into billions of real dollars requires examining LayerZero\u2019s OFT adapter model and the structural constraints that turned a theoretically catastrophic exploit into a contained incident.
When a project like The Sandbox deploys across multiple chains using LayerZero\u2019s OFT framework, the original tokens remain on the home chain (in this case, Ethereum). The Ethereum-side OFT Adapter locks genuine SAND tokens when a user bridges them outbound. On the destination chain, the OFT contract mints an equivalent amount. When a user bridges back, the destination chain burns the tokens and the adapter releases the locked originals.
The critical constraint is that the Ethereum adapter only holds as many tokens as users have previously bridged. On the night of Aug. 21, the adapter held a limited amount of SAND. Once the attacker drained those reserves, no additional backed SAND existed to extract, regardless of how many unbacked tokens the attacker continued to mint on Base.
This design means the exploit\u2019s blast radius was structurally bounded by the adapter\u2019s balance, not by the attacker\u2019s minting capacity. The trillions of tokens on Base became what one analyst called \u201caccounting ghosts,\u201d visible on explorers but redeemable against nothing. An attacker\u2019s fabricated balance becomes someone else\u2019s loss only when it reaches a pool containing genuine SAND, ETH, stablecoins, or other assets with real liquidity. With most of the legitimate reserves already drained in the first minute, the remaining minted tokens had nowhere to go.
There is a secondary channel of damage worth noting. Any decentralized exchange liquidity pools on Base that held genuine SAND paired against ETH or stablecoins were also vulnerable. If the attacker swapped unbacked SAND into those pools before liquidity providers could withdraw, the LPs absorbed losses beyond the Ethereum adapter drain. The Sandbox\u2019s decision to take a pre-incident snapshot and compensate eligible LPs suggests this secondary damage was not trivial, even if the team has not disclosed exact figures.
The Sandbox\u2019s response reinforced the primary containment. By zeroing the trusted peers via multisig, the team severed the cross-chain messaging channel. SAND on Base and BNB Smart Chain became isolated, unable to bridge back to Ethereum. The team then advised users not to buy, sell, or trade SAND on either affected chain. The Ethereum-side maximum supply cap of 3 billion SAND remained intact, and the Polygon deployment was unaffected.
A pattern across three incidents in five months
The Sandbox exploit did not occur in isolation. It was the third significant LayerZero-related bridge incident in five months, a pattern that has reshaped how the industry evaluates cross-chain infrastructure risk.
On April 18, 2026, attackers drained 116,500 rsETH worth approximately $292 million from a LayerZero-powered bridge operated by Kelp DAO. That attack was traced to a social engineering campaign that compromised a LayerZero Labs developer on March 6, giving the attacker access to the company\u2019s RPC cloud environment. The Kelp bridge used a 1-of-1 DVN (Decentralized Verifier Network) configuration, meaning a single compromised verifier could authorize fraudulent cross-chain messages.
In May, Stake DAO suffered a separate breach when a compromised deployer key reset a trusted peer setting, leading to 5.4 trillion vsdCRV minted for roughly $91,000 in extractable value.
The Sandbox incident followed a similar logic: application-level misconfiguration of cross-chain permissions created an opening for unauthorized minting. The mechanisms differed (approveAndCall versus social engineering versus key compromise), but the target was the same: the delegate or peer authority that controls who can trigger cross-chain token operations.
The $15 billion migration that followed
The cumulative effect of three LayerZero-related incidents in five months triggered a structural shift in how protocols choose their cross-chain infrastructure. By August 2026, publicly announced migrations from LayerZero to Chainlink\u2019s Cross-Chain Interoperability Protocol totaled approximately $15 billion in secured value.
BitGo led the migration wave by moving $7.4 billion in WBTC. Mantle shifted its $2.5 billion Super Portal. Lombard transferred over $1 billion in bitcoin-backed assets. Solv Protocol moved $700 million in tokenized bitcoin reserves. Kraken replaced LayerZero with Chainlink CCIP for its kBTC wrapped asset. On Aug. 18, just days before the Sandbox exploit, the Wyoming Stable Token Commission migrated its Frontier Stable Token to Chainlink CCIP across eight chains following a state-level security review.
LayerZero Labs acknowledged the earlier Kelp incident, with the company publicly stating it \u201cmade a mistake\u201d in the DVN configuration that Kelp used. The Sandbox exploit adds a new vector to the conversation: even when the underlying messaging protocol functions as designed, application-level integrations can create exploitable seams.
Chainlink\u2019s CCIP uses a different verification model that relies on a decentralized oracle network and a separate risk management network that independently validates every cross-chain transaction. The risk management network operates as an independent watchdog: even if the primary oracle network is compromised, the secondary layer can halt suspicious messages before they execute. This two-layer approach directly addresses the single-point-of-failure problem that enabled the Kelp DAO exploit, where a 1-of-1 DVN configuration meant one compromised verifier was sufficient to authorize fraud.
Whether that architecture proves more resilient over time remains an open question. Chainlink\u2019s model introduces its own trust assumptions, and no cross-chain system has proven immune to sophisticated attacks over a multi-year period. But the market has voted with its capital: $15 billion in migration announcements represents a level of institutional confidence shift that is difficult to reverse. When a state government (Wyoming) and major custodians (BitGo, Kraken) independently reach the same conclusion about infrastructure risk, the signal carries weight beyond any single incident.
What the market priced in
The market response to the Sandbox exploit contradicted what a casual observer might expect. Despite the $49 billion headline, SAND traded up 4.76% to $0.0476 in the 24 hours following the incident, with trading volume surging more than 400%.
Several factors may explain the counterintuitive price action. First, the rapid containment and transparent communication from The Sandbox team reassured holders that the Ethereum-side supply was intact. Second, Korean exchanges halting deposits and withdrawals under South Korea\u2019s Virtual Asset User Protection Act signaled regulatory seriousness about protecting traders. Third, some market participants may have interpreted the small actual extraction as evidence that the OFT adapter model worked as a structural safety net, even if the application-level permissions failed.
Coinbase delisted SAND perpetual futures, a precautionary move that reduced leverage exposure. The Sandbox announced it would take a pre-incident snapshot and compensate eligible liquidity providers on Base and BNB Smart Chain, though the timeline and mechanism for compensation were not immediately disclosed.
The price resilience should not be mistaken for absolution. The exploit exposed a configuration vulnerability that existed for at least 313 days, the dormancy period of the attacker\u2019s wallet, which was pre-positioned on Oct. 13, 2025. That one of the most recognizable names in Web3 gaming carried this exposure without detection raises questions about audit coverage for cross-chain deployments. The wallet\u2019s extended dormancy also suggests the attacker either discovered the vulnerability months before acting or acquired the wallet from someone who did.
DefiLlama logged 17 separate exploits in August 2026 alone, with bridges again emerging as the recurring weak point. Q2 2026 was described as \u201cthe most hacked quarter in DeFi history,\u201d with 99 exploits draining $746 million. Cumulative DeFi losses for the year exceeded $840 million by the end of May, and the Sandbox incident pushes the running total higher still. The question facing the industry is no longer whether bridges can be secured, but whether the current generation of bridge architectures should be trusted with significant capital at all.
What to watch
Post-mortem publication: The Sandbox promised a full post-mortem. Its depth, particularly around how the approveAndCall pathway was missed in prior audits, will signal how seriously the project treats the configuration gap.
Liquidity provider compensation: The snapshot-based compensation plan needs a timeline and token source. Watch whether affected LPs receive full restitution or a haircut.
LayerZero protocol-level mitigations: Whether LayerZero introduces guardrails to prevent delegate hijacking through token contract callbacks will indicate if the protocol views this as a systemic risk or a one-off configuration error.
Further migration announcements: If additional projects accelerate departures from LayerZero following this third incident, the migration wave could reshape the cross-chain infrastructure market before year-end.
Regulatory response in South Korea: Upbit and Bithumb acted under the Virtual Asset User Protection Act. Whether Korean regulators pursue further action against The Sandbox or LayerZero could set precedent for how bridge exploits are treated under consumer protection frameworks.
What is the approveAndCall function?
The approveAndCall function is an ERC-20 extension that lets a user approve a token spender and execute a follow-on contract call in a single transaction. It was designed to save gas and simplify multi-step interactions. In the Sandbox exploit, the attacker used this function to route a crafted payload through the SAND token contract into the LayerZero endpoint, effectively borrowing the token contract’s delegate authority over endpoint configuration.
How much money did the attacker actually steal?
The attacker extracted approximately 14.75 million SAND from the Ethereum OFT Adapter, converting the tokens to roughly 79.74 ETH, worth approximately $675,000 at the time of the transactions. While the face value of minted tokens reached $49 billion, that figure is an arithmetic artifact that could never have been realized as actual value.
Were SAND tokens on Ethereum and Polygon affected?
No. The exploit targeted the SAND OFT contract on Base and BNB Smart Chain. The Ethereum-side adapter contract and the Polygon deployment were not compromised. The maximum supply cap of 3 billion SAND on Ethereum remains intact.
Why did the attacker mint trillions of tokens if they could only extract $675,000?
The minting was automated across 703 events and 173 wallets over five hours. The attacker likely aimed to drain as much backed value as possible from the Ethereum adapter, but the adapter balance was limited. The excess minting beyond what the adapter held produced unbacked tokens with no redemption path.
Is this a flaw in LayerZero’s protocol?
Security researchers described the vulnerability as an application-level configuration failure, not a flaw in the LayerZero protocol itself. The issue was specific to how The Sandbox’s OFT contract on Base handled approveAndCall interactions with the LayerZero endpoint. However, the fact that three LayerZero-integrated bridges have been exploited in five months has intensified scrutiny of the protocol’s overall security model.
What did Korean exchanges do in response?
Upbit and Bithumb halted SAND deposits and withdrawals, citing suspected security incidents under South Korea’s Virtual Asset User Protection Act. Coinbase separately delisted SAND perpetual futures contracts.
Will affected liquidity providers be compensated?
The Sandbox announced plans to compensate eligible liquidity providers based on a pre-incident snapshot of balances on Base and BNB Smart Chain. The payment schedule and token source had not been disclosed as of Aug. 23, 2026.
How does this compare to other bridge exploits?
By nominal value, the $49 billion face-value figure would make this the largest bridge exploit in crypto history. By actual extraction, the $675,000 loss ranks among the smallest. The key difference is that earlier exploits like Ronin ($625 million) and Wormhole ($326 million) had sufficient bridge liquidity for attackers to drain backed assets at scale, while the Sandbox adapter held only a fraction of the total SAND supply, structurally limiting losses.
