Bridge Exploit Hijacks LayerZero Permissions
On August 28, 2026, a configuration flaw in a bridge between Base and BNB Smart Chain allowed attackers to hijack LayerZero delegate permissions. This let them mint 329 trillion unbacked SAND tokens in just five hours, according to a post-mortem by The Sandbox team. The attackers then drained roughly $675,000 from the Ethereum vault before the team shut the bridge down.
The exploit did not target the SAND smart contract itself but rather the bridge’s cross-chain messaging logic. By gaining delegate permissions, the attackers could forge messages that the bridge accepted as legitimate, triggering mints on BNB Smart Chain without corresponding deposits on Ethereum.
Why Phantom Mints Outweigh the Stolen Funds
The stolen amount is small, but the phantom tokens carry a face value of $49 billion based on SAND’s pre-exploit price. That figure dwarfs the actual theft, highlighting the systemic risk of bridge design. If the team had not detected and halted the minting, the excess supply could have crashed the market for SAND.
As of August 29, 2026, The Sandbox had paused all bridge operations and was working to burn the phantom tokens. The team stated that the Ethereum vault remains secure, but the incident raises questions about the security of cross-chain bridges that rely on delegate permissions.
LayerZero’s Roll in Cross-Chain Security
LayerZero is a messaging protocol that enables cross-chain communication, often used by bridges to transfer assets between networks. The flaw appears to be in how The Sandbox configured its LayerZero endpoints, not in LayerZero’s core protocol. A LayerZero spokesperson confirmed that the vulnerability was isolated to The Sandbox’s configuration and that no other projects were affected.
This incident echoes past bridge exploits, such as the $600 million Ronin bridge hack in 2022, but the scale of minted tokens here is unprecedented. The fact that attackers could mint trillions of tokens with a single misconfiguration underscores the need for stricter permission controls and real-time monitoring.
Market Impact and SAND Price Reaction
Following the news on August 28, SAND’s price fell roughly 12% from $0.15 to $0.132 before stabilizing. The broader crypto market remained calm, with Bitcoin and Ethereum trading flat over the same period, suggesting the incident was seen as isolated. However, the $49 billion phantom supply overhang continues to weigh on sentiment, as investors worry about potential sell pressure if any tokens remain unburned.
The Sandbox’s native token is currently trading at $0.135, down 10% from the pre-exploit level. Trading volume surged to 450 million SAND on August 29, triple the daily average, as traders reacted to the news.
What to Watch: Burn Completion and Bridge Reopening
The key number to watch is the total amount of phantom SAND that gets burned. The Sandbox has committed to a full burn, but if the burn is incomplete or delayed, the market could react negatively. Also watch for the reopening of the bridge, which the team says will happen only after a third-party audit of the configuration.
If the burn completes and the bridge reopens without further issues, SAND could recover. But any new exploit or delay would likely deepen losses. The next major update is expected within a week, and that will determine whether this is a temporary blip or a long-term credibility problem for The Sandbox.
Comments are closed.