Someone minted 49 billion dollars of SAND out of nothing over five hours on August 21 and 22, then walked away with about 675,000 dollars. That gap is the story. The Sandbox exploit produced one of the largest face-value token mints crypto has recorded, and almost none of it was worth a cent.
The attacker hijacked LayerZero delegate permissions on the SAND cross-chain contract, using an approveAndCall path to mint unbacked tokens on Base and BNB Chain. Blockaid put the face value near 49 billion dollars across more than 400 transactions. PeckShield counted the raw supply differently, at 14.9 billion new SAND across two addresses. The counts scatter because none of it was real inventory, just entries on two chains where nobody could sell at the quoted price.
The number that could not be spent
A mint is worth what a market will pay for it. No order book could absorb a sliver of 49 billion dollars of SAND at 0.047 cents a token, so the phantom balance stayed phantom. What actually left was small. The attacker drained roughly 14.75 million real SAND from the Ethereum adapter that holds the bridge's collateral, converting it to about 79.74 ETH in under a minute, around 675,000 dollars.
Put the two figures side by side and the face value runs more than 70,000 times larger than the money that moved. The Sandbox confirmed the lockbox on Ethereum, the collateral behind every bridged token, was never touched.
| Measure | Figure |
|---|---|
| Face value minted (Blockaid) | ~$49 billion |
| Real SAND drained from adapter | 14.75 million |
| Attacker realized | 79.74 ETH (~$675,000) |
| Chains isolated | Base, BNB Chain |
| Ethereum, Polygon supply | Unaffected |
What under 0.01 percent leaves out
The Sandbox told users the incident touched less than 0.01 percent of total SAND supply. The 14.75 million tokens that left the adapter sit closer to half a percent of circulating supply, and crypto.news pegged the true slice near 0.49 percent. Small either way. Still, the gap between the number the team chose and the number the chain shows is worth reading twice.
Markets barely flinched. Rather than crash on the fake-token headline, SAND traded up about 4.8 percent the next day on crypto.news and Coinpedia data, volume more than four times its usual pace, though one outlet logged a 4.4 percent dip instead. South Korean venues Bithumb and Upbit paused SAND deposits and withdrawals while they checked their exposure.
Forged supply finds no buyer
Anyone who watched the Wemix attacker mint 5.2 million tokens and leave with 724,000, or the Hyperbridge exploit that printed a billion bridged DOT and netted 237,000, knows the shape. Forged supply looks ruinous in the mint total and turns out modest in the cash-out, because it has no buyer. The scary number is the one nobody can realize. Days earlier a smaller loss cost far more, when a 3 million dollar exploit pushed BounceBit to retire its whole chain.
For holders the practical damage stops at frozen bridges on two networks and a contract that needs auditing before Base and BNB traffic reopens. The 49 billion dollar line will trail the token for a while, even though the attacker actually banked 675,000.
