The Sandbox says SAND bridge exploit drained 14,742,341.84 tokens from Ethereum vault
The Sandbox has released findings on a recent SAND bridge security incident. It said an attacker exploited a configuration function in the SAND token contract on Base and BNB Chain, where the contract also served as the LayerZero bridge integration, and set themselves as the sole verifier for incoming bridge messages. The attacker then stole about 14.74 million SAND from the Ethereum vault backing the bridge, roughly 0.5% of the fixed 3 billion maximum supply, while the team said it quickly contained the exploit and completed on-chain forensics.