Vulcan Forged Hack

Reported loss $140M
Ethereum Polygon
Private Key Compromised (Unknown Method)

What happened

On December 13, 2021, an attacker accessed private keys for 96 Vulcan Forged user wallets and took assets including about 4.5 million PYR, valued at roughly $140 million at the time. Vulcan Forged said it would reimburse affected users from its treasury and retire the semi-custodial wallet arrangement.

How it happened

  1. Vulcan Forged created and managed wallets for users instead of leaving private-key management entirely to those users.
  2. An attacker obtained access to the private keys of 96 such wallets.
  3. The wallets were drained of PYR; the report also notes that ETH and MATIC may have been taken.
  4. Vulcan Forged announced treasury-funded reimbursement and a move away from the semi-custodial design.

Protocol details

Classification Gaming / Metaverse / Key Compromise
Protocol Type Exploit/Access control
Affected asset / contract PYR
Protocol links Website @VulcanForged

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Same attack technique

Browse all hacks →
BtcTurk $54.0M lost Ethereum HTX $8.0M lost Arbitrum CoinEx $55.0M lost Ethereum Roll $5.7M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes