The Sandbox’s SAND cross-chain bridge was exploited after an attacker abused approveAndCall on the Base SAND OFT contract to hijack LayerZero delegate permissions. The attacker changed trusted cross-chain configuration, minted unbacked SAND on Base and BNB Chain, and used the compromised bridge path to extract approximately 14.75M backed SAND from the Ethereum OFT adapter. The Sandbox disabled bridging on Base and BNB Chain and stated that SAND on Ethereum and Polygon was unaffected at the token-contract level

The Sandbox’s SAND cross-chain bridge (LayerZero OFT on Base and BNB Chain) was exploited. The attacker used a configuration function to gain sole verifier rights, minting large amounts of unbacked SAND and draining approximately 14.74 million real SAND (~$675,000) from the Ethereum vault. The project quickly halted affected bridging; Ethereum and Polygon assets remained unaffected.