500m SAND minted on a Base contract that held 14.7m, and Upbit posts a caution

Comparing the mint to SAND's 3 billion cap understates what happened on the contract it came from. A BaseScan snapshot taken before the incident put the Base contract's total supply at 14.699 million SAND ^[6], which is under half a percent of the cap ^[1]. If the 500 million figure holds, about 97% of the SAND on that chain now originates with the suspected minter ^[2], and the deployment produced more than 34 times its own prior total ^[19].

The mechanics were not subtle. BaseScan showed the address linked to the unauthorised minting had run 302 transactions as of 05:23:10 UTC ^[9], averaging roughly 1.66 million SAND each ^[3], and Lookonchain described an infinite mint, in which minting permissions are compromised and the cap stops binding ^[7]. Cryptopolitan reported that individual transaction pages on BaseScan returned a bot-protection screen, so no exploit hash has been published ^[12]. Exchanges acted anyway, while the issuer has said nothing about the cause, how minting rights were obtained, or where the new tokens went ^[11].

Two earlier cases set the range of outcomes. In May 2024 Blockchain Game Partners said a compromised minter key let a contractor create 5 billion GALA on Ethereum, and the company blocklisted the wallet and burned the supply ^[13]. Harmony took the other route, rolling back its chain to reverse a mint of roughly 4 billion ONE, about 26% of supply, after a cross-shard flaw; ONE fell ^[14]. SAND's share of its own cap is around two-thirds of what Harmony reversed ^[5], which is a scale reference rather than a reassurance. Both remedies required something the issuer or its validators still controlled.

The dilution channel is specific. Tokens created without demand dilute existing holders, and the damage lands hardest if those tokens reach exchange order books ^[16]. On that reading the transfer freeze at Upbit and Bithumb ^[10] does more work than the caution banner, because it keeps the new units off two of the venues where they could be sold into bids.

There is also a measurement problem. Global Ledger tallied 224 publicly disclosed hacks and about $1.32 billion in losses over the year ^[18], an average near $5.9 million each ^[4]. A supply-side mint sits badly in that accounting: nothing leaves a treasury, so there is no clean loss figure to publish. The cost moves to holders through the float, and it only registers as a number once the tokens are sold.