SAND Bridge Exploit at The Sandbox: Why Not to Trade SAND on Base and BNB Chain Now

If you are holding SAND on Base or on BNB Smart Chain, the short answer is this: leave those tokens alone for now. The studio behind the metaverse project The Sandbox announced on August 22, 2026 that its cross-chain bridge on those two networks had been attacked and that unbacked SAND tokens were created in the process. Bridging to both chains has been halted since. Holdings on Ethereum and on Polygon are not affected, according to the studio.

For you as a holder the case therefore splits into two very different situations. If your SAND sits in a wallet on Ethereum or Polygon, or in an account at an exchange, nothing changes for you as things stand. If it sits on Base or on BNB Smart Chain, you are sitting on a holding that at present can neither be brought back over the official bridge nor traded at a reliable price. This article sorts out what is documented, which figures diverge widely and what you can concretely check over the next few days.

SAND Bridge Exploit: What Happened on Base and BNB Chain on August 22

The Sandbox is a metaverse platform whose payment and governance token is called SAND. The token originally exists on Ethereum and is mirrored onto other networks through what is known as a bridge. A bridge is a technical connection that locks a token on one chain and issues an equivalent on another chain, so that the same value becomes usable there.

That connection was precisely the target. According to the studio, a vulnerability in the bridge on Base and on BNB Smart Chain was exploited to issue SAND with no locked reserve behind it on Ethereum. In its statement on its own account on X, the studio says it has identified and fully contained the vulnerability, and that the impact amounts to less than 0.01 percent of the total SAND supply. The studio puts the total supply at three billion tokens; circulating supply stands at around 2.94 billion according to the figures cited in the reporting.

On the exact starting time the accounts diverge, and that belongs in an honest account. The trade outlet crypto.news dates the attack to August 22, 2026 at 11:07 UTC. The trade outlet The Defiant, by contrast, cites a report by the security firm Blockaid from 00:14 US Eastern time, that is 04:14 UTC, and dates the studio's statement to 03:22 US Eastern time, that is 07:22 UTC. The two accounts cannot be reconciled from a distance. What is certain is that the event ran on August 22 and was made public the same day.

Unbacked Tokens: What an Unbacked Mint Means at a Cross-Chain Bridge

An unbacked mint is the issuance of new tokens without the collateral intended for them having been deposited. At a bridge that is the core of the construction: a holding sits locked on the home chain, and only up to that amount may an equivalent exist on the target chain. If that coupling fails, tokens arise that look like the original but carry no claim on the reserve.

In practice that means the additionally created units are in circulation on Base and BNB Smart Chain, they carry the same name and the same symbol as regular SAND, and a trading venue on those chains cannot readily tell them apart from genuine SAND. The attacker only earns on the sale: the created units are worth something only as long as the market takes them for real.

The studio stresses that the reserve locked on Ethereum is intact and continues to back every regularly bridged token. That statement matters because it bounds the damage: what is affected is the issuing point, not the vault behind it.

LayerZero Delegate and approveAndCall: How the Attackers Got the Issuing Rights

The Sandbox bridge uses a standard called OFT, short for Omnichain Fungible Token, which runs over the LayerZero protocol. In that setup there is a role known as the delegate: an address allowed to manage a token's bridge settings, such as which counterparties on other chains count as trusted.

The security firm Blockaid traces the incident to those delegate rights being taken over, and names the approveAndCall function as the means. That function makes it possible to grant an approval and trigger a further instruction in a single step. As a result, the controls that normally prevent new tokens from arising without backing could be bypassed.

For you as an investor one thing above all matters here, and it reaches beyond this one token: the token itself was not faulty. What failed was the rights management of the bridge that mirrors it onto other chains. Anyone holding the same token on several networks is therefore holding several different risks.

14.9 Billion or 49 Billion: Why the Volume Figures Are So Far Apart

On the quantity of tokens created, figures are circulating that differ by orders of magnitude. The analytics firm PeckShield counted 14.9 billion SAND across two addresses, according to The Defiant. Blockaid put the issuance as of 00:14 US Eastern time at a nominal value of around $49 billion across more than 400 transactions. The trade portal The Cryptotimes reported a considerably higher number of units created on Base.

That spread is explained by the measure being used. One figure counts tokens, the other multiplies created tokens by the last traded price and arrives at a nominal value. A nominal value is a purely arithmetical quantity: it says what the tokens would be worth if somebody bought them at the current price. With a holding that amounts to a multiple of the entire circulating supply, that buyer does not exist.

You should therefore not read the large billion-scale numbers from the headlines as a loss figure. They describe how much paper was printed, not how much money flowed out.

The Actual Outflow: 14.75 Million SAND and Around 80 ETH

The documented outflow is considerably smaller. According to matching statements from crypto.news and other trade outlets, around 14.75 million genuine SAND were drawn out of the Ethereum adapter and converted into roughly 79.74 ETH, which corresponded to about $675,000 at the price at the time. That is the figure describing the real loss.

The price reacted visibly but not dramatically. Cryptobriefing cites a fall from $0.052 to $0.044 with a subsequent recovery to about $0.048. How those figures relate to current quotes is best checked by you directly; prices from a report of the previous day are a snapshot, not a state.

Bridging Halted: What the Isolation of Base and BSC Means for Your Balance

The studio's first measure was to switch off transfers over the bridge to and from Base as well as to and from BNB Smart Chain. On top of that, according to the trade outlets, the LayerZero peer settings were removed, meaning the records of which counterparties count as trusted. That leaves the unbacked tokens unable to reach the reserve on Ethereum.

For you that means an uncomfortable but bounded situation. Your SAND on Base or BSC has not vanished and still sits in your wallet. What you cannot do at the moment is bring it back to Ethereum by the official route, because that route is closed. The studio has so far attached no date to its reopening.

The studio has announced a full incident report. Until it is available, any statement about how the affected holdings will ultimately be treated is conjecture. We expressly do not claim here that your holding will be preserved in full, and just as little the opposite.

SAND on Ethereum and Polygon: Why the Studio Says These Holdings Are Untouched

According to the published statements, the vulnerability concerned the bridge infrastructure and not the original token contract on Ethereum. The studio stated that no user wallets had been compromised and that the backing locked on Ethereum was fully present. Polygon is likewise listed as unaffected in every report reviewed.

That is why the distinction by network matters more in this case than the question of how much SAND you hold. Two investors with the same holding and the same wallet software can be in entirely different situations, depending on which chain their tokens sit on.

First Check: How to Find Out Which Chain Your SAND Tokens Sit On

The chain is stated in your wallet, you only have to know where to look. In the common software wallets you select the network at the top; the balance you are shown always belongs to the network currently selected. If it says Ethereum or Polygon, you are not in the affected group as things stand. If it says Base or BNB Smart Chain, you are. Which wallet programs map that switch cleanly is shown in our software wallet comparison.

A second route runs through the block explorer of the chain in question. There you enter your public address and see which tokens are assigned to that address on that one chain. What matters here is that the same address can exist on several chains and holds a different balance on each.

If your SAND sits in an account at a trading platform, you did not make that choice yourself. In that case the provider decides which chain it custodies the token on, and the right question for customer support is whether deposits and withdrawals for SAND are currently open and which network they run over.

Liquidity Providers on Base and BSC: What the Announced Snapshot Means

A liquidity provider is someone who deposits two tokens into a trading pool so that others can swap there, and receives a share of the fees for it. Those pools are precisely the most vulnerable point in an unbacked mint, because the attacker can swap their worthless tokens there against the genuine other side.

The studio has announced that it will take a snapshot, meaning a record of balances from before the attack, and compensate eligible liquidity providers on that basis. A date, a sum and the conditions for eligibility are not yet settled. If you are in that group, secure your own records now: transaction hashes, timestamps and balances from your wallet history are harder to reconstruct later than today.

Upbit and Bithumb: Why Two Exchanges Halted Deposits and Withdrawals

The two South Korean trading venues Upbit and Bithumb have suspended deposits and withdrawals for SAND. The Defiant gives Friday evening US Eastern time as the moment and points to the South Korean law on the protection of virtual asset users, which obliges trading venues to take such steps when irregularities appear.

For you in Europe that is less a piece of news about Korea than a pointer to a pattern. When a token gets into a situation like this, trading venues freeze transfers first, often before they publicly explain why. A holding in an exchange account can therefore become immovable at exactly the moment you want to move it.

Trading on a DEX: Why a Cheap SAND Price on Base Is No Bargain Right Now

A DEX, meaning a decentralised exchange, swaps tokens directly out of a liquidity pool, with no company in between. It does not check whether a token is backed; it only checks whether it matches the technical address stored in the pool. As long as unbacked SAND units are in circulation on Base and BSC, a low price displayed there can simply mean that somebody is offloading worthless tokens.

The studio has therefore expressly called on users neither to buy nor to sell SAND on Base and BNB Smart Chain for the time being, and not to provide liquidity there either. That recommendation comes from the issuer of the token itself and is the clearest guidance available in this case. Anyone who buys in anyway because the price looks tempting may be purchasing exactly the units that made up the incident.

Wrapped Tokens and Bridges: The Risk This Case Shows in General

A bridged token, often also called a wrapped token, certifies a claim on an original held somewhere else. That claim is worth exactly as much as the technology and the rights management that redeem it. For you that means two positions with the same name in your portfolio tracker can have very different collateral behind them.

No warning against bridges as such follows from this, because without them many applications would be unusable across several chains. What follows is a simple bookkeeping rule: note which token you hold on which chain, and treat a bridged holding as a position of its own with a risk of its own. That note costs you five minutes and, on a day like August 22, answers the decisive question immediately.

Anyone who self-custodies anyway has an advantage at this point: they see the chain directly and do not depend on a provider disclosing it.

Where the SAND Bridge Exploit Stands: What Is Documented and What Remains Open

It is documented that The Sandbox made an attack on the bridge to Base and to BNB Smart Chain public on August 22, 2026, halted bridging to both chains and put the impact at less than 0.01 percent of total supply. Also documented is the outflow of around 14.75 million SAND and about 79.74 ETH, as well as the suspension of transfers at two South Korean trading venues.

Open questions are when bridging will be released again, how the unbacked units will ultimately be treated, on what criteria the announced compensation will run and what the full incident report will find. Also open is the exact starting time of the attack, on which the sources contradict each other. On the question of whether and how the rights to the bridge could have been better protected we offer no view; we have nothing before us that goes beyond the accounts of those involved.

Checking Your SAND Holdings: What to Take Away

1. Establish the chain before you do anything else. Open your wallet, switch through the networks and record where your SAND actually sits. Only on Base and BNB Smart Chain are you affected. If you notice in the process that your wallet maps the networks confusingly, our NFT marketplace comparison lists providers that show metaverse holdings cleanly by chain.
2. Sit still on the affected networks and document. No buying, no selling, no liquidity on Base and BSC while the isolation lasts. In parallel, secure your transaction records for possible compensation. If your holding sits in an exchange account, ask there about the status of deposits and withdrawals; which providers are supervised in the EU and how they communicate in situations like this is shown in our comparison of regulated crypto exchanges.
3. Draw the lesson for the rest of your portfolio. Check which of your tokens are bridged versions and separate them from the originals in your own overview. Anyone holding larger amounts for the long term is better off in self-custody; the devices for that stand side by side in our hardware wallet comparison.

Limits of This Account

All details of the sequence of events come from the studio's statement and from the reporting of the trade outlets named; we have not carried out our own analysis of the transactions on Base and BSC. The sources in detail: the statement by The Sandbox of August 22, 2026 on the @TheSandboxGame account on X and the crypto.news report on the SAND bridge exploit.

(As of August 23, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)