South Korean crypto exchanges Upbit and Bithumb have placed The Sandbox’s SAND token under investment caution after a security issue involving its cross-chain bridge remained unresolved.
The warning comes after unusual SAND minting activity was detected on Base and BNB Smart Chain. The Sandbox said a vulnerability in its bridge allowed an attacker to create SAND that was not backed by tokens locked on Ethereum.
Upbit announced the caution designation on Aug. 24. The warning covers SAND trading against the Korean won and Bitcoin. Deposits and withdrawals had already been suspended on Aug. 22, while trading remains available during the review.
Bithumb also placed SAND under caution at 3 p.m. KST on Aug. 24. The exchange had stopped SAND deposits and withdrawals shortly after detecting signs of a possible security problem.
The Sandbox said it found and contained a vulnerability affecting its SAND bridge on Base and BNB Smart Chain. The project disabled bridging to and from both networks to prevent further problems.
According to The Sandbox, the actual amount affected was less than 0.01% of SAND’s total supply. The project said SAND held on Ethereum and Polygon was not affected, and no user wallets were compromised.
The team also said the SAND locked on Ethereum to support legitimate bridged tokens remains secure. SAND on Base and BNB Smart Chain has been isolated while the bridge remains disabled.
The Sandbox has warned users not to buy, sell or trade SAND on those two networks while liquidity remains affected.
Security firm Blockaid reported that attackers were able to take control of LayerZero delegate permissions through a function connected to SAND’s cross-chain setup. This allowed a large amount of unbacked SAND to be created across many transactions.
The Sandbox has taken a snapshot of balances from before the incident and is working on a compensation plan for eligible liquidity providers affected on Base and BNB Smart Chain. The project also plans to release a full investigation report and technical review once the investigation is finished.
Upbit will review SAND from Aug. 24 through the fifth week of September. After the review, the exchange could remove the warning, extend it or decide to end trading support for the token.
Upbit said unresolved security problems can lead to the removal of trading support. Any decision to extend the warning or delist SAND will be announced separately.
The exchange also said SAND deposits made after the warning was issued will not be credited normally and will instead be processed for return. SAND has also been removed from assets available for new borrowing through Upbit’s lending service.
Bithumb has a similar review process, with its decision expected between Sept. 28 and Oct. 2. The exchange could remove the warning, extend it or end trading support depending on the results of its investigation.
The SAND case is not the first time Korean exchanges have used investment warnings after security incidents. Exchanges have previously removed warnings when projects showed that vulnerabilities had been fixed and proper security measures were put in place.
However, serious security problems can also lead to delisting. Earlier this year, Upbit, Bithumb and Coinone moved toward ending support for FLOW after a major protocol exploit. The incident involved duplicated tokens and caused losses of around $3.9 million.
The latest SAND incident also comes as South Korean regulators continue to focus on security at crypto exchanges. The Financial Supervisory Service has been examining security failures and how exchanges protect users after major wallet breaches.
For SAND holders, the key issue now is whether The Sandbox can fully resolve the bridge problem and give exchanges enough evidence to remove their warnings. Until then, trading conditions could remain volatile, especially on the affected networks.
