SAND Exploit Mints $49B, Theft Limited to $675K
The SAND exploit exposed a configuration flaw in a LayerZero-based omnichain token contract on Base. Between 21 and 22 August 2026, attackers used the approveAndCall function to hijack delegate permissions and mint 329.24 trillion unbacked SAND across 703 transactions over roughly five hours.
Although the phantom tokens had a notional value of nearly $49 billion, liquidity constraints limited the realised loss. The attacker withdrew about 14.74–14.75 million SAND from the Ethereum OFT Adapter in less than a minute and converted the funds into roughly 80 ETH, worth about $675,000. Earlier trading activity also involved counterfeit SAND being sold on Base decentralised exchanges. Ethereum and Polygon SAND, user wallets and the project’s private keys were not compromised.
The Sandbox disabled the affected bridge contracts on Base and BNB Chain, removed LayerZero peer settings through multisig governance and said the old contracts would be retired. It plans to reimburse eligible holders on a 1:1 basis from its treasury, without issuing new SAND. Coinbase and Binance held most affected balances and were expected to distribute compensation, while personal-wallet users must claim through a dedicated portal. Upbit and Bithumb suspended SAND transfers, and Coinbase delisted SAND perpetual futures.
SAND fell nearly 10% intraday but recovered most of the loss within 24 hours. Traders should monitor the reimbursement process, exchange support, bridge relaunch, contract audits, liquidity and any migration from LayerZero to Chainlink CCIP. The incident remains a bearish short-term catalyst and highlights continuing cross-chain bridge security risks.
Bearish
The SAND exploit is bearish for SAND in the short term because it created a large supply overhang, disrupted bridging and triggered exchange transfer restrictions. The nearly 10% intraday decline shows that traders responded quickly to the security breach, even though most of the loss was later recovered. Counterfeit-token sales, potential compensation claims and uncertainty over exchange support may continue to increase volatility and limit demand.
The impact is partly contained because the attacker realised only about $675,000, user wallets and Ethereum and Polygon assets were not compromised, and The Sandbox plans a treasury-funded 1:1 reimbursement without new SAND issuance. These measures reduce the risk of permanent dilution and could support a recovery after the compensation process and audits are completed. However, bridge relaunch uncertainty, possible contract migration and broader concerns over LayerZero-related security failures remain negative for investor confidence. The expected price impact on SAND is therefore bearish, with the greatest pressure likely in the short term.