Sandbox Says Bridge Exploit Was ‘Minimal’ - On-Chain Data Tells A Very Different Story

• The Sandbox called a bridge exploit on Base and BNB Smart Chain "minimal," but PeckShield flagged 14.9 billion SAND minted across two attacker addresses.
• Blockaid also detected $49 billion in face-value unbacked SAND minted across 400+ transactions.
• The exploit was the latest incident involving LayerZero-powered bridge infrastructure in 2026, following the $290 million KelpDAO hack in April.

Metaverse gaming platform The Sandbox called an exploit on its cross-chain bridge “minimal,” but on-chain security firms flagged token mining equivalent to five times the metaverse project's entire max supply.

The Sandbox said on Saturday that it had identified and “fully contained” a vulnerability in its SAND bridge on Base and BNB Smart Chain (BSC), estimating the impact at least 0.01% of the total token supply. No user wallets were compromised, and SAND on Ethereum (ETH) and Polygon (POL) was not affected, the project said.

The gaming platform explained that it had disabled bridging to and from both Base and BSC, isolating the affected tokens so they could not be moved, and the team warned users not to buy, sell, or trade SAND on either network while liquidity was compromised. The project further said it was taking a pre-incident snapshot and preparing a compensation plan for affected liquidity providers.

On-Chain Firms Flag Bigger Picture

Blockchain security firm PeckShield, however, flagged 14.9 billion SAND minted across two attacker addresses, roughly five times the token’s 3 billion max supply. 

Separately, Blockaid described the $49 billion as "face-value" SAND, meaning the figure reflected the market price applied to unbacked tokens rather than money the attacker actually extracted. The Sandbox said the SAND locked on Ethereum that backed all bridged tokens was "fully intact."

SAND Price Holds

Despite the exploit, SAND's price was relatively steady, down only 0.6% over the past 24 hours but up over 16% over the week. 

On Stocktwits, retail sentiment around SAND remained in the ‘bullish’ zone, while chatter stayed at 'high' levels over the past day. 

The exploit is the latest incident involving LayerZero-powered bridging infrastructure this year. In April, attackers linked to North Korea's Lazarus Group had drained nearly $290 million in rsETH from KelpDAO's LayerZero bridge by forging a cross-chain message. LayerZero later acknowledged it "made a mistake" by allowing its own verification network to secure high-value assets in a vulnerable setup. 

Read also: Bitcoin Hits Its Stride As Dollar Weakness And Treasury Buybacks Fuel Hard-Asset Rally, Galaxy Analysts Call Bottom

For updates and corrections, email newsroom[at]stocktwits[dot]com.