The Sandbox Says It Contained Bridge Exploit Minting Unbacked SAND

What happened in the SAND bridge exploit

The incident hit bridge infrastructure connecting SAND across chains, not an ordinary token transfer, and it resulted in the creation of SAND tokens that were not backed by locked collateral on the origin chain, as reported by The Defiant. For related coverage, see Ripple Tests XRP Trade Finance in MAS Singapore Sandbox.

The unbacked SAND was minted on both Base and BSC, spanning two separate networks where the bridged representation of the token circulates. The Sandbox stated that it contained the exploit, a claim that originates from the project itself rather than an independent audit, per co-founder Sebastien Borget. For related coverage, see Solana Cuts Mainnet Slot Time to 350ms in Push Toward 200ms.

The Sandbox subsequently halted bridging activity across the affected networks, a step covered in more detail in our report on how Sandbox paused Base and BNB Chain bridging after the exploit. For related coverage, see Solana Activates 350-Millisecond Slots on Mainnet.

Why unbacked cross-chain minting is a risk event

Unbacked minting breaks the core invariant of a bridge: every wrapped or bridged unit is supposed to be redeemable against collateral locked on the source chain. When tokens appear without that backing, the bridged supply no longer reconciles with the canonical supply, creating an accounting mismatch. For related coverage, see Circle targets Sept. 16 for Arc public mainnet launch.

Because the mints landed on both Base and BSC, the risk is not isolated to one liquidity pool or one deployment. Attacker-minted SAND that reaches an AMM can be sold against real liquidity, draining honest LPs and transferring the loss to depositors and holders of the bridged asset.

The threat surface here is the bridge layer specifically. The brief does not establish any flaw in the underlying SAND contract on its native chain, so the exploit should be read as a cross-chain messaging or mint-authority failure rather than a compromise of the base token itself. Security firm Blockaid flagged activity tied to the incident, in its own post on X.

What to watch after containment

Containment is a claim about stopping the bleeding, not proof of full remediation. The open questions are whether the unbacked SAND is burned, how the project reconciles bridged supply against locked collateral, and when, or whether, bridging resumes on each chain.

A credible post-mortem should account for the exact minted amount, the mint-authority path the attacker used, and the reconciliation of supply across Base and BSC. None of those figures are confirmed in the current evidence, and readers should treat any specific loss numbers circulating elsewhere as unverified until the project publishes an incident report.

The most concrete near-term signal will be the bridge restart status per network, since a resumed bridge implies the mint-authority defect has been closed and supply has been reconciled.

Additional source references: source document 1.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.