A $49 billion mint that was not $49 billion — what a bridged token actually is

The Sandbox, a blockchain gaming network, shut down its bridges to Base and BNB Smart Chain after an attacker found a way to mint SAND tokens that nothing was backing. The security firm Blockaid put the face value of the newly created tokens at roughly $49 billion across more than 400 transactions — a figure worth pausing on, because SAND’s entire market capitalisation is about $136 million.

Start with that number, because it is the part most likely to mislead. The $49 billion is not money stolen. It applies SAND’s market price to tokens conjured out of nothing, and there was never anywhere near that much liquidity to sell them into. A second security firm, PeckShield, counted 14.9 billion SAND minted across two addresses. The two figures were measured at different stages of the incident, and both describe nominal token creation rather than confirmed losses. The Sandbox said the impact was under 0.01% of SAND’s 3 billion token supply — fewer than 300,000 tokens by that measure — without defining what it meant by impact or reconciling it with the other numbers.

The mechanism is the useful part for a beginner. A bridged token is not the original token. When SAND moves from Ethereum to another chain, the original stays locked on Ethereum and a representation is minted on the far side, and that representation is only worth something as long as the locked collateral and the bridge’s minting rules both hold. Blockaid said the attacker hijacked LayerZero delegate permissions through an approveAndCall function and minted SAND that no locked collateral stood behind. Disabling the bridges freezes those copies where they are: SAND on Base and BNB Smart Chain currently cannot be moved or redeemed.

The Sandbox said SAND on Ethereum and Polygon was unaffected, that no user wallets were compromised, and that the SAND locked on Ethereum to back the bridged supply remains intact. It told users not to buy, sell or trade the token on the two affected chains because liquidity there had been compromised. The South Korean exchanges Bithumb and Upbit suspended SAND deposits and withdrawals. The company said it took a snapshot from before the incident and is preparing compensation for qualifying users of the affected liquidity pools, with a technical post-mortem to follow. SAND fell close to 10% intraday and ended the day down about 0.8%.

Two habits are worth taking away. First, a token with the same name and ticker is not automatically the same asset on every chain — the chain you hold it on decides which contract and which bridge you are trusting. Second, when an exploit is reported with an enormous dollar figure, check whether that number is what an attacker could actually sell or simply the market price multiplied by tokens that were invented. And if a project asks people to stop trading on a specific network, the safe move is to stop, wait for the post-mortem, and treat anyone who slides into a private chat offering to buy your stranded tokens as a second attack. This is information, not advice.