Sandbox SAND Bridge Vulnerability: Why not trade SAND on Base and BNB chains now

If your SAND tokens are deposited on Base or BNB smart chains, the concise answer is: don't touch these tokens for a while.

The studio of the metaverse project The Sandbox announced on August 22, 2026 that its cross-chain bridges on the two networks were attacked and unsecured SAND tokens were generated during the process. The bridging function to these two chains has been suspended. The studio said tokens stored on Ethereum and Polygon would not be affected.

As a holder, you face two very different situations. If your SAND is stored in a wallet on Ethereum or Polygon, or in an exchange account, the current situation remains unchanged for you. If it is deposited on Base or BNB smart chains, the assets you hold cannot currently be transferred back through official bridges, nor can they be traded at reliable prices. This article combs through known information, data with huge differences, and points you can verify in detail in the next few days.

SAND Bridging Vulnerability: What happened on the Base and BNB chains on August 22

The Sandbox is a meta-universe platform with a payment and governance token named SAND. The token originally existed on Ethereum and was mirrored to other networks through so-called bridging technology. Bridging is a technical connection that locks a token on one chain and issues an equal amount of token on another chain, so that the same value can be used there.

The target of this attack was this connection. The studio stated that the bridge between Base and BNB smart chains was flawed and was used to issue SAND without the support of lock-in reserves on Ethereum. The studio's official account on the X platform stated that the vulnerability had been discovered and completely controlled, with an impact of less than 0.01% of SAND's total supply. The studio said the total supply was 3 billion coins; according to data cited in the report, the circulation supply was approximately 2.94 billion coins.

Regarding the specific time of the attack, various parties have different opinions, which needs to be explained truthfully. Trading media crypto.news set the attack time at 11:07 UTC on August 22, 2026. Trading media The Defiant quoted a report from security company Blockaid, saying that an attack occurred at 00:14 EDT (04:14 UTC) and set the time stated by the studio at 03:22 EDT (07:22 UTC). These two statements cannot be reconciled from the outside. What is certain is that the incident occurred on August 22 and was made public that day.

Unsecured Tokens: What does an "unsecured issuance" on a cross-chain bridge mean?

Unsecured issuance refers to the issuance of new tokens without the corresponding collateral being deposited. In the bridging mechanism, this is the core principle: assets are locked on the original chain, and only the same amount of corresponding tokens can exist on the target chain. If this correspondence fails, a token will be created that appears to be the same as the original token but cannot claim a reserve.

In effect, this means that the extra generated tokens are circulated on Base and BNB smart chains, with the same name and symbol as ordinary SAND, and the trading venues on these chains have difficulty distinguishing them from the real SAND. Attackers can only make a profit by selling: these generated tokens have value only if the market treats them as real tokens.

The studio emphasized that the reserves locked on Ethereum are intact and continue to support every token that is normally bridged. This statement is important because it limits the scope of the damage: it is the point of issuance that is affected, not the treasury behind it.

LayerZero's Delegate and approveAndCall: How attackers gain distribution rights

The Sandbox's bridging uses a standard called OFT (Full Chain Homogenization Tokens), which runs on top of the LayerZero protocol. In this setup, there is a role called a "delegate": an address that has the authority to manage token bridging settings (such as which other counterparties on the chain are considered trustworthy).

Security company Blockaid traced the incident to the takeover of these delegated rights and pointed out that the approveAndCall function was the modus operandi. This function allows approval to be granted and further instructions triggered in a single step. As a result, controls that typically prevent the creation of unsecured tokens are circumvented.

As an investor, the thing you need to pay attention to most is this-this goes beyond the scope of a single token: there is no problem with the token itself. The problem lies in bridging rights management that mirrors it to other chains. Therefore, people holding the same token on multiple networks actually hold multiple different risks.

Guaranteed and unsecured tokens look exactly the same on the screen: the only difference is whether the token is backed by locked reserves.

14.9 billion or 49 billion: Why the transaction volume data differ so much

Regarding the number of tokens generated, circulating data differ by several orders of magnitude. According to The Defiant, analyst firm PeckShield calculated a total of 14.9 billion SAND at the two addresses. Blockaid said that as of 00:14 AEST, the nominal value of issuance was approximately US$49 billion, involving more than 400 transactions. Trading portal The Cryptotimes reported that the number of tokens generated on Base is much higher.

This difference stems from the metrics used. One data counts the number of tokens, and the other is to multiply the generated tokens by the final transaction price to get the nominal value. Nominal value is a purely arithmetic concept: it expresses how much these tokens would be worth if someone purchased them at the current price. But faced with a position equivalent to several times the entire circulation supply, such a buyer does not exist.

Therefore, you should not interpret the huge billions of figures in headlines as losses. They describe how much "paper" is "printed", not how much money is flowing out.

Actual outflow: 14.75 million SAND and about 80 ETH

The recorded outflow is much smaller. According to crypto.news and other trading media reports, approximately 14.75 million real SAND were extracted from the Ethereum adapter and converted into approximately 79.74 ETH, or approximately US$675,000 at the time. This is the value that describes the actual loss.

The price reaction was obvious but not drastic. Cryptobrief cited data as saying the price fell from $0.052 to $0.044, before recovering to about $0.048. The relationship between this data and the current quote is best verified directly by you; the price reported on the previous day is only a snapshot, not the current status.

Bridge Suspension: The impact of Base and BSC isolation on your balance

The studio's first action is to turn off bridge transfers to and out of the Base and BNB intelligent chains. In addition, according to transaction media reports, LayerZero's peer settings have been removed, that is, records of which counterparties are considered trustworthy have also been deleted. This prevents unsecured tokens from reaching the reserves on Ethereum.

For you, this means a disturbing but limited situation. Your SAND on Base or BSC has not disappeared, it is still in your wallet. You cannot currently transfer it back to Ethereum through official channels because the channel has been closed. The studio has not announced a specific date for its reopening.

The studio has announced that it will release a full incident report. Prior to the report's release, any suggestion of what would ultimately be done with the affected assets was just speculation. We hereby make it clear that we do not guarantee that your assets will be retained intact, nor do we guarantee the contrary.

SAND on Ethereum and Polygon: Why the studio claims these assets are unaffected

According to released statements, the vulnerability involves bridging infrastructure, not the original token contract on Ethereum. The studio stated that no user wallets were hacked and the guarantee money locked on Ethereum was completely present. In all reviewed reports, Polygon was also listed as unaffected.

This is why in this case, distinguishing by network is more important than how much SAND you have. Two investors holding the same amount and using the same wallet software could face completely different situations, depending on which chain their tokens are deposited on.

First check: How to determine which chain your SAND tokens are stored on

Chain information will be displayed in your wallet, you just need to know where to view it. In common software wallets, you can select the network at the top; the balance displayed to you always belongs to the currently selected network. If it appears as Ethereum or Polygon, you are not currently affected. If it displays as Base or BNB Intelligent Chain, you are affected. Which wallet programs can clearly display this switch? Please refer to our Software Wallet Comparison.

The second method is through a blockchain browser with a related chain. You enter your public address to see which tokens are allocated on the chain by that address. It should be noted that the same address can exist on multiple chains, and the balance on each chain is different.

If your SAND is deposited in an account on the trading platform, you have not made this choice. In this case, it is up to the service provider to decide on which chain to hold the tokens, and the correct question you should ask customer service is whether SAND's refunds and withdrawals are currently open and on which network they run.

Decoupling rather than losing: As long as the connection to the main chain is closed, the assets on the Base and BSC remain in place.

Liquidity providers on Base and BSC: What published snapshots mean

A liquidity provider is a person who deposits two tokens into a trading pool so that others can redeem them and receive a share of fees from them. These pools are the most vulnerable part of unsecured offerings, because attackers can exchange their worthless tokens for real other assets there.

The studio has announced that it will conduct a snapshot, which records the balance before the attack and compensates eligible liquidity providers accordingly. Specific dates, amounts and eligibility conditions have not yet been determined. If you belong to this group, save your own records immediately: transaction hashes, timestamps, and balances in your wallet history, and rebuilding in the future will be much more difficult than it is now.

Upbit and Bithumb: Why two exchanges suspend top-ups and withdrawals

Two South Korean trading platforms, Upbit and Bithumb, have suspended top-ups and withdrawals from SAND. The Defiant said the suspension would be approximately Friday night Eastern Time and noted that under South Korea's Virtual Asset User Protection Act, exchanges are obligated to take such measures when abnormal circumstances occur.

For you in Europe, this is not so much news about South Korea as pointing out a pattern. When a token falls into this situation, the exchange first freezes the transfer, often before publicly explaining why. As a result, assets in an exchange account may become immobile just when you want to move.

Trading on DEX: Why low-priced SAND on Base is not currently a bargain

DEX (decentralized exchange) converts tokens directly from the liquidity pool without company intervention. It does not check whether the token is guaranteed, only whether it matches the technical address stored in the pool. As long as unsecured SAND tokens are circulated on Base and BSC, the low prices displayed there may simply mean that someone is selling worthless tokens.

Therefore, the studio clearly calls on users not to buy and sell SAND on Base and BNB smart chains for the time being, and not to provide liquidity. This advice comes from the token issuer itself and is the clearest guidance in this case. Anyone who bought because the price was tempting may have bought the coins that made up the incident.

Wrapped tokens and bridging: Common risks revealed by this case

Bridging tokens (also commonly referred to as wrapping tokens) demonstrate ownership of original assets stored elsewhere. The value of this ownership depends entirely on the technology and rights management used to redeem it. For you, this means that two positions in your portfolio tracker with the same name but different chains may have very different guarantees behind them.

This is not a warning against using bridging technology, because without bridging, many applications will not be available on multiple chains. What follows is just a simple accounting rule: Keep track of which tokens you hold on which chain and treat the bridging asset as a separate position with its own risk. It only takes you five minutes, and on a day like August 22, it will answer that critical question immediately.

Anyone who keeps their own assets has an advantage at this point: they can see chain information directly without having to rely on service provider disclosures.

Status of SAND Bridge Vulnerability: Known Information and Issues to Be Resolved

Known Information: The Sandbox disclosed an attack on the Bridge of Base and BNB intelligent chains on August 22, 2026, suspended the bridging to these two chains, and set the scope of impact to less than 0.01% of the total supply. Also known are the outflow of approximately 14.75 million SAND and approximately 79.74 ETH, as well as the suspension of transfers from two South Korean trading platforms.

Open questions: When will the bridge reopen, what will ultimately be done with unsecured tokens, what criteria will be used for announced compensation, and what conclusions will be drawn from a full incident report. In addition, the specific start time of the attack remains unclear, and the news from all parties is contradictory. We have no comment on whether and how bridging rights are better protected; we do not have any information at hand beyond what is stated by the parties concerned.

Check your SAND position: Action Points

Determine chain information before taking any action. Open your wallet, switch between networks, and record where your SAND is actually stored. Only on Base and BNB smart chains will you be affected. If you find that your wallet network display is confusing during this process, our NFT Market Comparison lists service providers that can clearly display meta-universe assets by chain.

Stay still on the affected network and make records. During the quarantine period, do not buy, sell or provide liquidity on Base and BSC. At the same time, keep your transaction records for possible compensation. If your assets are held in an exchange account, please check with customer service for the status of deposits and withdrawals; which service providers are regulated in the EU and how they communicate in such situations, please see our Regulated Cryptocurrency Exchange Comparison.

Learn lessons for other assets in your portfolio. Check which tokens you have are bridging versions and separate them from the original tokens in your own overview. Investors who hold large amounts for a long time are more suitable to keep their own assets; please refer to our hardware wallet comparison for related equipment.

Limitations of this article

All incident details are derived from studio statements and reports from the transaction media mentioned; we did not conduct independent analysis of transactions on Base and BSC. Specific sources: The Sandbox's statement on the X Platform @TheSandboxGame account on August 22, 2026, and crypto.news's report on the SAND bridging vulnerability.

(As of August 23, 2026. This article does not constitute investment advice. Price and fee structures are subject to change; please verify terms with your service provider before purchasing.)