The Sandbox pushes new engine build: lighting, animation and template overhauls. Last Updated: September 5, 2026 * The Sandbox has taken a new engine update live for its creator tooling, pointing to upgrades in lighting and animation, fresh templates and game examples, and reworked editor workflows. * It arrives after an Aug. 12 beta that rebuilt how the engine handles scenes, and a July 23 release that broke two legacy APIs. * Rather than spelling the changes out in the announcement itself, the company put the complete changelog on its Creator Hub. The Sandbox has rolled out a new update to its creator engine, according to a company post on X. Four areas were named in that post: improved lighting and animations, additional templates and game examples, smoother workflows in the editor, and what the studio described as "Tons of fixes + reliability improvements." Instead of listing individual changes, it directed readers to the release notes hosted on the Creator Hub at create.sandbox.game/updates/10. It reaches a creator community that has already absorbed two engine shifts since July. Coming off a scene system rebuild. Core architecture was reworked in the Aug. 12 beta. Everything placed in a scene - meshes, characters and cameras - was folded into a single unified system, and prefabs were promoted to what the notes termed a "true first-class building block," editable and savable in place, with per-instance overrides that preserve the connection back to the original. The Outliner and Inspector were rebuilt in that release around the unified scene node tree. Prefab bugs responsible for accidental deletions, ignored settings, older prefab files that refused to open and broken sessions that corrupted scenes were also addressed. The same pass cleared a navmesh debug visualization crash on WebGPU as well as incorrect alpha blending in WebGPU postprocess masks, which had been corrupting selection outlines. A second wave of compatibility shims carried over from 13 to 14 was stripped out in version 14.0.2, with nothing put in their place. July update broke two APIs. The breaking changes came with the July 23 release. Legacy *.anim.json animation state machine configs no longer function at runtime, which leaves only serialized *.animconfig.json resources. VirtualJoystickOptions.hidden was also dropped after its deprecation period, with enabled: false taking over. An "engine-upgrades" AI Assistant skill now ships with new projects, along with a standalone migration script that converts old configs and rewrites the references pointing at them. By default the script only runs dry; passing -write commits the changes. That same update brought in the MoverComponent locomotion stack - with Walking, Falling, Flying, Airplane, TopDown and Vehicle modes - plus MoverCharacterPawn and MoverPlayerController, which take the place of hand-rolled per-pawn movement. Opt-in top speed caps, reduced steering at high speed, and per-wheel tuning for brakes, friction and power share were added to VehicleMovementComponent. Fog support and WebGPU/TSL authored background and environment nodes were added to scene environment data, meaning shader graph fog and sky setups can now drive a scene instead of relying purely on texture-based environments. GPU timing landed in the profiler, and InputManager gained an API for skinning, repositioning or switching off on-screen touch controls. The minimum SDK was raised to 13.3.7, with 13.0.0 acting as the auto-update recovery floor. Installs older than that are stopped at startup until they update. Templates keep expanding. Work on templates started before this release. Four Asset Libraries arrived with Game Maker 0.12 - The British Museum, Architecture, Interior design: Furniture and lamps, and Terrain Colors - together with three Game Type Templates covering Shooters, Action RPG and Business Tycoon. Smiley Factory, built by The Smiley Company, sits on top of that tycoon template. Within a 15 to 20 minute limit, players operate a Smiley branded production line, crafting apparel and plowing earnings back in to open up more rooms. Jam running alongside. A Beta Creators Game Jam using The Sandbox Studio opened on Aug. 12, following July's Alpha Creator Game Jam. Larry "Major Nelson" Hryb serves as lead judge. Prizes total $7,500, split $2,500 for first place, $1,600 for second and $1,000 for third.

The Sandbox reports security incident impacting cross-chain bridging infrastructure. August 24, 2026 @ 3:44 pm By Omar Faridi The Sandbox, the blockchain-based metaverse and gaming platform, faced a significant security incident involving its cross-chain bridging infrastructure. The vulnerability allowed an unauthorized party to generate large volumes of SAND tokens without proper collateral on the Base and BNB Smart Chain networks. Security researchers first detected unusual activity around August 21-22, 2026. Firms such as Blockaid and PeckShield reported that an attacker had compromised permissions tied to the project's LayerZero-based Omnichain Fungible Token (OFT) setup. By exploiting a function known as approveAndCall, the actor gained the ability to create tokens on the secondary chains without corresponding locked SAND on Ethereum. The Sandbox team has identified and fully contained a recent vulnerability regarding the SAND cross-chain bridge on Base and BNB Smart Chain (BSC). The impact is minimal, representing less than 0.01% of the total SAND token supply. SAND tokens on Ethereum and Polygon are NOT... - The Sandbox (@TheSandboxGame) August 22, 2026 Early alerts noted hundreds of millions of tokens appearing, with subsequent tallies showing roughly 14.9 billion SAND directed to a pair of addresses linked to the activity. Broader estimates placed the face-value total of newly created tokens in the tens of billions of dollars across hundreds of transactions. Some analyses even described far higher nominal figures distributed over multiple addresses during a multi-hour window. Despite the scale of the unauthorized minting, the real-world financial impact remained limited. Investigators determined that only about 14.75 million legitimately backed SAND - valued at approximately $675,000 at the time - left the Ethereum-side bridge adapter, along with a modest amount of ETH. The Sandbox itself assessed the overall effect at less than 0.01 percent of the token's legitimate maximum supply of 3 billion. The project responded swiftly. Officials confirmed they had identified and fully contained the issue. Bridging functions to and from Base and BNB Smart Chain were disabled, effectively isolating the unbacked tokens so they could not be moved or redeemed against the Ethereum collateral. SAND held on Ethereum and Polygon remained completely unaffected. No individual user wallets were compromised, and the SAND locked on Ethereum that underpins all bridged tokens stayed secure. Major exchanges reacted cautiously. South Korean platforms Upbit and Bithumb suspended SAND deposits and withdrawals. Users were strongly advised not to buy, sell, or trade the token on the affected networks while liquidity there remained compromised. The Sandbox said it captured a pre-incident snapshot of balances and is preparing a compensation framework for eligible liquidity providers affected by the event. The team pledged to release a full technical post-mortem once its investigation concludes. Community members affected by liquidity pool disruptions were directed to contact official support channels. The episode underscores ongoing challenges with cross-chain bridges and omnichain token designs in the broader cryptocurrency ecosystem. While the rapid isolation of the affected networks prevented wider damage, it also highlighted how permission and delegate mechanisms can become points of failure. For SAND holders on the primary chains, the incident appears to have been successfully limited, with core infrastructure and user assets preserved. This event serves as another reminder of the importance of security reviews for multi-chain deployments as blockchain projects continue expanding their interoperability features. Sponsored Links by DQ Promote

Sandbox bridge exploit mints 14.9B unbacked SAND on Base and BSC. 2026-08-23 04:37:57 Key takeaways. * The Sandbox suffered a bridge exploit on August 21 that minted 14.9 billion unbacked SAND tokens on Base and BSC networks. * Peckshield identified 14.9 billion unbacked SAND tokens, nearly five times larger than SAND's 3 billion legitimate total supply. * The Sandbox disabled bridging immediately after detection and plans compensation for affected liquidity providers before restoring bridges. The Sandbox, the metaverse gaming platform behind the SAND token, contained a bridge exploit on August 21 that minted approximately 14.9 billion unbacked SAND tokens across Base and BNB Smart Chain (BSC) networks. The attacker exploited vulnerabilities in the bridges' minting mechanism, creating tokens without real backing on both networks. The Sandbox disabled bridging on Base and BSC immediately after detection, preventing further unauthorized token movement. Bridge exploits have topped $320 million in losses across the crypto industry over the first half of the year, with attackers increasingly targeting smart contracts that connect separate blockchains. Attacker exploits Base and BSC bridge minting mechanism. The Sandbox contained a vulnerability affecting its cross-chain bridges on Base and BNB Smart Chain (BSC). An attacker exploited the bridges' minting mechanism to create SAND tokens with no real backing on both networks. The Sandbox disabled bridging on Base and BSC as soon as the exploit was detected, cutting off the attacker's ability to move the fabricated tokens further. The Sandbox's bridge infrastructure normally works by locking SAND on one chain, typically Ethereum, and minting an equivalent, fully backed amount on the destination network. That 1:1 backing model broke down in this incident, allowing tokens to be minted on Base and BSC without a matching lock on the source chain. The Sandbox said the incident affected less than 0.01% of SAND's total supply in terms of genuine backing at risk. SAND held on Ethereum and Polygon, user wallets across the ecosystem, and the Ethereum-locked assets that back the token remained untouched throughout the exploit, the company said. Peckshield identifies 14.9 billion unbacked SAND across two addresses. Peckshield identified approximately 14.9 billion unbacked SAND minted across two addresses tied to the exploit. The scale of that figure stands out given SAND's legitimate total supply is capped at 3 billion tokens, meaning the minted amount was nearly five times larger than every real SAND token that has ever existed or will exist. The mismatch is common in bridge exploits, where an attacker manipulates a smart contract's mint function rather than actually stealing locked collateral. Similar mint-based attacks have hit other protocols throughout the year, including a bridge exploit that let an attacker mint 1 billion unauthorized DOT tokens on Polkadot's bridge earlier in the year, and a smaller incident where roughly 13.76 million unbacked ALPH tokens were created on the Alephium bridge. The platform is preparing a compensation plan for eligible liquidity providers who held positions affected by the unbacked minting, and it has advised users not to trade SAND on Base or BSC until the bridges are restored. Bridge exploits top $320 million in industry losses. Bridge exploits have topped $320 million in losses across the crypto industry over the first half of the year, as attackers have increasingly started targeting the smart contracts that connect separate blockchains rather than individual protocols. The pattern includes the Gravity Bridge exploit that saw a hacker drain $5.4 million and route the funds through Binance before the trail went cold. The next step for The Sandbox is a post-mortem on how the bridge's minting controls failed and a security audit before Base and BSC bridging is switched back on. Coinbase plans to delist SAND futures on August 26. SAND was trading near $0.039 as of this week. Coinbase announced its plans to delist ten perpetual futures contracts, including SAND, effective August 26, as part of a broader review of trading volume and liquidity across its derivatives markets. Open positions will be settled automatically at that point. Faq. What happened in The Sandbox bridge exploit on August 21? An attacker exploited vulnerabilities in The Sandbox's cross-chain bridges on Base and BNB Smart Chain (BSC) to mint approximately 14.9 billion unbacked SAND tokens across two addresses. The Sandbox disabled bridging on Base and BSC immediately after detection to prevent further unauthorized token movement. How much SAND was minted compared to the legitimate total supply? Peckshield identified approximately 14.9 billion unbacked SAND minted in the exploit. SAND's legitimate total supply is capped at 3 billion tokens, meaning the minted amount was nearly five times larger than every real SAND token that has ever existed or will exist. When will Coinbase delist SAND futures contracts? Coinbase announced its plans to delist ten perpetual futures contracts, including SAND, effective August 26, as part of a broader review of trading volume and liquidity across its derivatives markets. Open positions will be settled automatically at that point. Disclaimer: The information on this page may come from third-party sources and is for reference only. It does not represent the views or opinions of Gate and does not constitute any financial, investment, or legal advice. Virtual asset trading involves high risk. Please do not rely solely on the information on this page when making decisions. For details, see the Disclaimer.