Jdscarlett27

Let’s break down what actually happened because the headlines are messier than the mechanism
Sandbox’s sand token uses an omnichain fungible token setup through layerzero
This lets sand move between ethereum base bnb chain and polygon
Each chain has a delegate role controlling minting permissions

Blockaid flagged it first around 04:14 utc
Attacker hijacked the delegate role on base and used approveandcall to mint sand with no eth backing behind it
Face value minted hit roughly $49b across 400+ transactions
Peckshield separately tracked 14.9b sand minted across two addresses at 05:40 utc

Here’s the detail most posts are missing
Blockaid clarified this is not a layerzero bug
The flaw sits in sandbox’s own oft contract on base
Approveandcall let the attacker call setdelegate and mint through a forged lzreceive
Layerzero’s own contracts behaved exactly as designed
Know the difference between protocol risk and app level config risk
It changes who needs to fix what

Sandbox confirmed at 07:22 utc
Vulnerability identified and fully contained
Real impact under 0.01% of total sand supply
Eth and polygon sand unaffected
No user wallets compromised
Eth locked backing for all bridged sand fully intact

Immediate response
Bridging to and from base and bnb chain disabled
Sand on both networks isolated can’t be moved or redeemed
Users told plainly don’t buy sell or trade sand on base or bsc
A pre incident snapshot was taken
Compensation plan in prep for qualifying lp holders
Full technical postmortem still to come

This is the same failure category as harmony’s one token incident and the coreum xrp drain earlier this month
Not a consensus failure
Not a smart contract bug everyone already audits for
A permission on one chain nobody double checked

My personal take?
Don’t panic sell on a scary mint number
Check what’s actually backed what’s actually moved and how fast the team contained it
Sandbox isolated the damage in hours and kept the core asset intact
That’s the difference between an incident and a collapse

This isn’t an isolated story either
THORChain, the protocol Maya forked from, lost about 10.8 million three months earlier
Same lineage, same class of risk, different specific bugs

Six individually small cracks don’t look dangerous on their own
Chain them in the right order inside one transaction and they become one large exit door
That’s the actual lesson here

Audits check known patterns
They don’t always catch what happens when several passing checks get combined in a sequence nobody tested together
Most poeple might not know it yet but composition risk is quietly one of the most underrated categories in DeFi security 🧘‍♂️

@walsxbt Municipality of Wals

Everyone keeps arguing about whether crypto has already peaked
Meanwhile, only about 6.8% of the world owns crypto
That’s roughly 562M people out of a global population of 8B+
So more than 90% of humanity still has no crypto exposure
That changes how I look at the market
The loudest part of crypto is not necessarily the most adopted
Nigeria, India, Pakistan, Vietnam and the Philippines continue to show strong grassroots adoption while many markets dominating CT conversations remain relatively underpenetrated
The next wave doesn’t need to come from existing crypto users buying more
It can come