The Sandbox said it has “identified and fully contained” a vulnerability in the SAND cross-chain bridge that let an attacker mint unbacked SAND on Base and BNB Smart Chain, and that it has switched off bridging to and from both networks, leaving the SAND on those chains isolated and unable to be moved or redeemed.

In a statement posted at 3:22 a.m. ET Saturday, the studio behind the virtual-world game told users not to buy, sell or trade SAND on Base or BSC because liquidity on those networks is compromised. It said no user wallets were compromised, that SAND on Ethereum and Polygon is unaffected, and that the SAND locked on Ethereum backing all bridged SAND is fully intact. It put the impact at “less than 0.01% of total SAND supply.”

Security firm Blockaid described the mechanism hours earlier. Attackers hijacked LayerZero delegate permissions through a function called `approveAndCall` on SAND’s omnichain fungible token contract on Base, the firm said. An omnichain fungible token, or OFT, is the cross-chain version of a token, and its delegate role governs who is authorized to mint new units on a given chain. Blockaid put the face value minted at about $49 billion across more than 400 transactions as of 12:14 a.m. ET, and said the attack was still going.

PeckShield, in an alert published at 1:40 a.m. ET, counted 14.9 billion SAND minted across two addresses, 0xAbE0…4D22 and 0x638C…F296. Block-explorer screenshots attached to the alert show the addresses holding 14.65 billion and 250 million SAND, credited in repeated transfers from the null address — the zero address newly created tokens are issued from — dated Aug. 22.

Those counts and the company’s are hard to square. PeckShield’s 14.9 billion tokens is several times SAND’s entire circulating supply of about 2.94 billion, against a 3 billion maximum, according to CoinGecko. The Sandbox has not said what its “less than 0.01%” figure measures or published a loss figure in dollars. Blockaid’s and PeckShield’s totals were published an hour and a half apart while minting was described as ongoing, and neither firm has reconciled its number with the other’s.

Two South Korean exchanges had already frozen SAND transfers. Upbit suspended SAND deposits and withdrawals on the Ethereum network in a notice registered at 10:12 p.m. ET Friday, or 11:12 a.m. KST Saturday, citing circumstances indicating a security incident at The Sandbox and invoking a user-protection provision of South Korea’s Virtual Asset User Protection Act. The suspension runs until the exchange confirms deposit and withdrawal stability, it said, adding that it will work closely with the project team. Ethereum is the chain The Sandbox says was not affected.

Upbit followed with a trading caution at 10:45 p.m. ET, saying circumstances suspected to be a security problem on The Sandbox network were confirmed on Aug. 22 and warning that SAND’s price volatility could widen. The notice pointed users to token transactions of the Base address 0x67624BFadee937c9281B4f98Ce18aF1bee01257e on BaseScan as the transactions related to the suspected problem.

Bithumb suspended SAND deposits and withdrawals from 11:11 a.m. KST Saturday, or 10:11 p.m. ET Friday, citing suspected security-problem circumstances and the same law, and said service would resume once network stability is confirmed. Trading remains available during the suspension, the exchange said, warning that sharp price swings may occur. The notice was read from a screenshot of Bithumb’s notice page circulated by Wu Blockchain rather than from the exchange’s own site.

Markets have priced none of it in. SAND changed hands at $0.0479 as of 4:12 a.m. ET Saturday, up about 4.6% over 24 hours and about 22% over seven days, for a market capitalization of roughly $140.8 million, according to CoinGecko.

The Sandbox said it is taking a snapshot of positions from before the incident and preparing a compensation plan for qualified users of the affected liquidity pools, and promised a full incident report and technical post-mortem. Neither Upbit nor Bithumb has said when transfers will reopen.