The Sandbox contains SAND bridge exploit on Base and BNB Smart Chain

The Sandbox contained a vulnerability after an attacker minted unbacked SAND on Base and BNB Smart Chain. The project said the impact was under 0.01% of total SAND supply. Blockaid flagged the incident on Saturday. Blockaid said attackers hijacked LayerZero delegate permissions through the approveAndCall function. Blockaid said about $49 billion in face-value SAND was minted across more than 400 transactions. The Sandbox disabled bridging to and from Base and BNB Smart Chain. The project said SAND locked on Ethereum backs all bridged tokens and remains intact. The project told users not to buy, sell, or trade SAND on either network because liquidity there was compromised. The Sandbox is preparing compensation for qualifying liquidity providers and said it would publish a full post-mortem. Bithumb suspended SAND deposits and withdrawals at 11:11 a.m. KST. Upbit suspended transfers one minute later. Upbit halted transfers of Ethereum-based SAND, which the project said was never at risk. DefiLlama has logged 17 separate exploits so far this month.