# Attacker Hijacks Delegate Rights on The Sandbox's Cross-Chain Token and Mints Unbacked SAND

The gaming network disabled bridging to Base and BNB Smart Chain and said the direct impact was under 0.01% of supply, though researchers put the actual extraction near $675,000 against tens of billions of dollars in face-value tokens.

- Published: 2026-08-23T05:46:20.809Z
- Canonical: https://polylog.news/crypto/2026-08-23/attacker-hijacks-delegate-rights-on-the-sandbox-s-cross-chai
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/web3/2026/08/22/web3-gaming-network-sandbox-stops-base-and-bnb-chain-bridging-after-exploit), [crypto.news](https://crypto.news/sand-bridge-exploit-contained-unbacked-token-mint/), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/c2f157e5e86557bf03888b6f5b9ac5064964f19e)

The Sandbox, the blockchain gaming network behind the SAND token, [stopped bridging on Base and BNB Smart Chain](https://www.coindesk.com/web3/2026/08/22/web3-gaming-network-sandbox-stops-base-and-bnb-chain-bridging-after-exploit) after an attacker minted SAND on those networks with nothing locked behind it. The company warned users not to trade SAND on the affected chains and put the direct impact at less than 0.01% of the token's 3 billion supply, a figure [crypto.news also reported](https://crypto.news/sand-bridge-exploit-contained-unbacked-token-mint/).

The mechanism was not a broken mathematical assumption. It was privileged configuration. The token uses the omnichain fungible token standard from LayerZero, a cross-chain messaging protocol, in which a designated delegate account can set the contract's messaging configuration. According to the proof-of-concept [published by DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/c2f157e5e86557bf03888b6f5b9ac5064964f19e) and a parallel [reconstruction of the same path](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/0a5b4fe307ff4864c25e555517f6cee9de8e5b07), the attacker reached that delegate role through the token's approveAndCall function, then used the resulting control to have destination-chain contracts credit tokens that no source-chain deposit backed.

The headline numbers and the real numbers diverge sharply. Security researchers cited by [The Cryptonomist and other outlets](https://www.cryptotimes.io/2026/08/22/sandbox-sand-hacked-attackers-mint-329-trillion-tokens-on-base-in-5-hour-rampage/) counted hundreds of mint transactions creating tens of billions of dollars of face-value SAND. Tokens created without backing cannot be sold for anything close to their nominal value, because the order books on Base and BNB Smart Chain are thin. The extraction that mattered ran through the Ethereum-side adapter, roughly 14.75 million SAND, about $675,000, part of which was converted into ether. The Sandbox says it is preparing compensation for affected liquidity providers.

The pattern is familiar and getting expensive. Cross-chain token standards concentrate authority in a small set of administrative roles, and those roles are frequently reachable through a function nobody modelled as an entry point. The contract behaved as written, but the permission model failed to anticipate that a callback function could reach the delegate role.

## What this means

Those bearing the loss are the automated market maker liquidity providers on Base and BNB Smart Chain who took unbacked tokens in exchange for real assets, and secondarily any holder whose SAND cannot currently be moved because the bridges are disabled. The wider consequence is a discount on any asset whose supply integrity depends on a delegate key in a cross-chain messaging contract, which now includes a large share of tokens deployed on more than one network. Expect exchanges and market makers to widen spreads or suspend bridged versions of such tokens before investigating further.

## What to watch

- Whether The Sandbox publishes an on-chain accounting of the compensation to liquidity providers, which tests whether "under 0.01% of supply" describes the loss or only the part the company recognises.
- Whether other projects using the same omnichain token standard audit and restrict their delegate roles, since the entry point is now public in reproducible form.
- Whether the stolen ether moves to a mixing service or a swap venue without identity checks, which usually decides whether attribution is possible at all.