Sandbox hit by a major security breach as attackers mint 49B of unbacked $SAND

[fullfitlarry]

https://x.com/coinbureau/status/2091096287483756752

As what the saying goes, another day, another hack. In this case, at least they said that they are going to compensate for those who are affected. And they were able to isolated SAND liquidity on BSC and Base. It could be worst if they didn't stop it and gonna be too late when they discovered it.

So this is going to be tough for projects moving forward. But I guess they will need to really monitor everything and review their code or have someone to be there to always check the health of their system.

[Orpichukwu]

Another day, another attack, indeed, and it’s getting worse. We can’t tell which layer is going to get hacked next or which wallet. Maybe one of these prediction markets is going to make option betting for it since they can bet on anything.

Good thing the team behind Sandbox was fast enough to take action, and Exchanges (centralised) was also fast to disable incoming deposits on the warning chains; it was reported that 14.75 million SAND, worth $675,000 according to market value, was lost on the Ethereum OFT adapter, and only about roughly 80ETH has been converted by the hacker from the funds stolen.

The Sandbox SAND Exploit: $49B in New Tokens Flood Base [/quote]

[asriloni]

The problem was not in Sandbox, but it's on LayerZero OFT. This is two times LayerZero OFT became the main causes of crypto exploit due to the its cross chain minting. We had kelpDOA who became the first victim then this one. So i guess the bridge developers have to regularly audit their code.

The cross-chain bridge becomes one of weakest spot that often being targeted by the exploiters. The only solutioni to limiting the creativity owned by smart contract to mint the new asset for the bridging purpose.

This will be a never ending incident if the broken bridge team behind Layer zero still let its contract to always mint the asset used for bridging purpose.

Apart from that like i said audit is needed but this incident signalling if they're not learning from their previous case happened in kelp DAO.

[Localhostspeed]

As what the saying goes, another day, another hack. In this case, at least they said that they are going to compensate for those who are affected. And they were able to isolated SAND liquidity on BSC and Base. It could be worst if they didn't stop it and gonna be too late when they discovered it.

So this is going to be tough for projects moving forward. But I guess they will need to really monitor everything and review their code or have someone to be there to always check the health of their system.

Everyday, these coins shows that altcoins are total failure, they are not worth investing into because they are useless. I can't count how many Defi projects that were hack this year, they are many and guess what? They have the same pattern. This Sandbox, I don't know why the hack seems to be the moving news for the project failure, sometimes I think this things are insider, the price is almost nothing, no development about the project, suddenly an exploit.

There is something about these coins. They used to be valuable but as soon as unlock occur, they goes downtrend in their price until they are almost forget.



Look at what I'm talking about, this price is nothing before the chain was exploited and even now the price is trading at the price not different from when it was traded.

[Taskford]

Another day, another attack, indeed, and it’s getting worse. We can’t tell which layer is going to get hacked next or which wallet. Maybe one of these prediction markets is going to make option betting for it since they can bet on anything.

Good thing the team behind Sandbox was fast enough to take action, and Exchanges (centralised) was also fast to disable incoming deposits on the warning chains; it was reported that 14.75 million SAND, worth $675,000 according to market value, was lost on the Ethereum OFT adapter, and only about roughly 80ETH has been converted by the hacker from the funds stolen.

The Sandbox SAND Exploit: $49B in New Tokens Flood Base

If I'm not wrong with what I remember just this month of August. We already experience 8 hacking incidents on which several of those attack cause huge damage to its users.

Also as what I read they act fast and take immediate actions within 10 minutes or lower than that. If it happens they didn't notice it immediately, maybe that breach will leave them more devastating damage.

To many exploits happening this days. Maybe its time for platform owners to do security checks. Because we don't know which platform will be the next target pf sad attacks.

[MArsland]

If I'm not wrong with what I remember just this month of August. We already experience 8 hacking incidents on which several of those attack cause huge damage to its users.

Also as what I read they act fast and take immediate actions within 10 minutes or lower than that. If it happens they didn't notice it immediately, maybe that breach will leave them more devastating damage.

To many exploits happening this days. Maybe its time for platform owners to do security checks. Because we don't know which platform will be the next target pf sad attacks.

defillama
Over the course of August, more than $18 million worth of assets were hacked, not counting $SAND $49 billion. It all comes from 15 entities : Allbridge, Maya Protocol, Fox Market, Harmony Bridge, Coinsbuy, Coreum Bridge, USM, Atomic Green, Oraichain, Panther Protocol, Rrwallet, Unistreets, RISEx, MOKE, and LOOPSDAO. If compared to the value of assets lost in August is still below the month of July, because the Coldcard incident was the most shocking.

[nelson4lov]

The problem was not in Sandbox, but it's on LayerZero OFT. This is two times LayerZero OFT became the main causes of crypto exploit due to the its cross chain minting. We had kelpDOA who became the first victim then this one. So i guess the bridge developers have to regularly audit their code.

The cross-chain bridge becomes one of weakest spot that often being targeted by the exploiters. The only solutioni to limiting the creativity owned by smart contract to mint the new asset for the bridging purpose.

This will be a never ending incident if the broken bridge team behind Layer zero still let its contract to always mint the asset used for bridging purpose.

Apart from that like i said audit is needed but this incident signalling if they're not learning from their previous case happened in kelp DAO.

I agree with you that LayerZero shares in the blame. I just wanted to note a couple of things:

1. LayerZero has done several audits in the past on Code4rena and they currently have one of the highest paying bug bounty on Immunefi with a max payout of $15m. So the solution is not just more audits, since no audit makes a system hack-proof.

2. The minting design is not the problem because Chainlink's CCIP does the same thing. Even as Kelp moved to CCIP after their hack, their tokens still get minted on destination chain just as they were with LayerZero OFT. The difference is that Chainlink's CCIP verification is harder to misconfigure since every message needs two separate networks to agree, and unlike LayerZero, projects get Chainlink's Risk Management Network instead of picking their own verifiers.

[TastyChillySauce00]

Anyone noticed that it's almost becoming daily occurrence to see a project getting hacked? It's actually crazy how almost everyday my X timeline is full of project hacking reports if we are counting the hacks that is below $1 million as well.

2. The minting design is not the problem because Chainlink's CCIP does the same thing. Even as Kelp moved to CCIP after their hack, their tokens still get minted on destination chain just as they were with LayerZero OFT. The difference is that Chainlink's CCIP verification is harder to misconfigure since every message needs two separate networks to agree, and unlike LayerZero, projects get Chainlink's Risk Management Network instead of picking their own verifiers.

It's true, LayerZero is too permissive on allowing custom logic and application level configuration loosely, it has been a problem so far. The approveAndCall function that is being used to exploit was inherited from SendBaseToken contract and not from the OFTCore. The Sandbox developer, apparently mixed SendBaseToken and OFTCore code which caused logic flaw in OFTSand contract.

This is exactly what going to happen if the bridge allow anyone to write their own logic.

[Orpichukwu]

Another day, another attack, indeed, and it’s getting worse. We can’t tell which layer is going to get hacked next or which wallet. Maybe one of these prediction markets is going to make option betting for it since they can bet on anything.

Good thing the team behind Sandbox was fast enough to take action, and Exchanges (centralised) was also fast to disable incoming deposits on the warning chains; it was reported that 14.75 million SAND, worth $675,000 according to market value, was lost on the Ethereum OFT adapter, and only about roughly 80ETH has been converted by the hacker from the funds stolen.

The Sandbox SAND Exploit: $49B in New Tokens Flood Base

Also as what I read they act fast and take immediate actions within 10 minutes or lower than that. If it happens they didn't notice it immediately, maybe that breach will leave them more devastating damage.

That is what saved them; at least this attack did not make them lose much, and they only have to worry about a few hundred thousand dollars, which they will use to repay the affected, according to what they said.

To many exploits happening this days. Maybe its time for platform owners to do security checks. Because we don't know which platform will be the next target pf sad attacks.

It’s not a matter of "maybe" for any service, especially crypto-related ones that don’t want to learn from this exploit happening; then they are not serious with their security. They can also deploy some paid AI to test their system and see if some bugs can be found and get them fixed before anything.

Over the course of August, more than $18 million worth of assets were hacked, not counting $SAND $49 billion. It all comes from 15 entities : Allbridge, Maya Protocol, Fox Market, Harmony Bridge, Coinsbuy, Coreum Bridge, USM, Atomic Green, Oraichain, Panther Protocol, Rrwallet, Unistreets, RISEx, MOKE, and LOOPSDAO. If compared to the value of assets lost in August is still below the month of July, because the Coldcard incident was the most shocking.

It’s not $49 billion worth of sand tokens that were stolen or lost; the 49 billion represents the amount of tokens which were affected, and from some of the sources, it was said only part of that number was successfully stolen and converted.

[Slow death]

This year there have been many news reports about cases of crimes committed by hackers in the cryptocurrency market, at least that has been my perception, but speaking specifically about Sandbox, this project has not been successful. I remember when I bought it in 2021 for $2 and sold it as soon as it reached $6. At the time, I even asked my brother to buy it for $2 and told him to sell it as soon as the price reached $6. Interestingly, it later went up to $8, but I didn't regret selling. What followed was a price drop.



It's a dead project, so why would anyone spend time attacking it? What would they gain from it? Honestly, it's strange. Look, the price of Bitcoin is rising a lot, and yet the price of Sandbox hasn't reacted; it remains as if there hasn't been a significant increase in the price of Bitcoin. So why would anyone spend time on their computer attacking this dead project? It's something I'm very curious to know.