News

An incident occurred in the Web3 community, affecting one of the notable projects in the metaverse space — The Sandbox. We are talking about unauthorized access to a cross‑chain contract that is responsible for moving SAND tokens between different blockchains. The target of the attack was an OFT contract (Omnichain Fungible Token) deployed on the Base network, which is part of the Coinbase ecosystem.

Analysts from Blockaid, who specialize in the security of decentralized applications, have found that the attackers gained access to the delegated authority mechanism associated with the LayerZero protocol. This system allows third parties to act on behalf of other participants, which the hackers exploited by bypassing the standard verification. They used the approveAndCall function, which usually simplifies contract interaction, but in this case it served as a tool for issuing tokens without any backing.

Initially, it was reported that 500 million SAND were involved — about 16.7% of the total volume of 3 billion. However, later PeckShield, which tracks blockchain operations, detected 14.9 billion SAND already on two addresses linked to the attack. Blockaid clarified that, in dollar terms, the total volume of generated tokens reached 49 billion, and this required more than 400 transactions.

The actual damage turned out to be much more modest than the nominal figures. The main losses occurred on the Ethereum OFT adapter, from which 14.75 million SAND were withdrawn — approximately 675,000 dollars at that time. Some of the funds have already been transferred to ETH (about 79.74 coins). A huge amount of tokens that were created remained illiquid and did not enter the open markets.

The exchanges responded promptly. Bithumb suspended deposits and withdrawals of SAND, and Upbit issued a warning about caution when dealing with the asset. The measures were preventive, aimed at avoiding price spikes and speculation.

The Sandbox developers issued a statement: the vulnerability concerned only the bridge between Base and BNB Smart Chain (formerly BSC). Ethereum and Polygon were not affected, and users’ wallets are intact. Tokens locked on the Ethereum mainnet are safe. The team disabled transfers between Base and BSC, blocking further issuance. The community was advised to refrain from trading SAND on these networks until the situation is resolved. Compensation for losses to liquidity providers has also been promised.

The market reacted cautiously: SAND fell in price by 2.6% to 0.04661, and its market capitalization amounted to 136.6 million. The daily trading volume increased by 239.5% — to 88.2 million, which indicates increased interest among traders.

This is not the first time for The Sandbox. In 2025, the project’s head’s Twitter account was hacked for a phishing token distribution. A year earlier, the company carried out a restructuring: it changed its leadership and laid off more than half of its staff, citing a decline in interest in metaverses.