Vulcan Forged
A blockchain-gaming ecosystem on Polygon whose semi-custodial wallets were drained of about $140M on December 13, 2021. Attackers compromised Vulcan Forged's servers to obtain its wallet-provider (Venly) credentials and export 96 users' private keys; the team reimbursed users from its treasury.
Also known as: Vulcan Forged, PYR, MyForge
Summary
Vulcan Forged is a blockchain game studio that also ran an NFT marketplace and a DEX around its PYR token. On December 13, 2021, an attacker drained about $140 million from 96 user wallets — roughly 4.5 million PYR plus ETH and MATIC. [1][2]
Cause and response
Vulcan Forged managed semi-custodial wallets for users via the provider Venly. According to the company, attackers compromised Vulcan Forged's own servers, obtained the Venly credentials, and used them to export users' private keys (Venly said its own systems were not breached). The team reimbursed affected users from its treasury and said it would move to fully decentralized (self-custody) wallets. [1][2]
Bracketed numbers refer to the numbered sources listed below.
Sources (2)
See also
World Liberty Financial (WLFI) — Justin Sun token freezeProjectsWLFI, a DeFi project linked to Donald Trump and his family, blacklisted/froze the wallet of major investor Justin Sun in Sept 2025 — ~540–595M unlocked WLFI tokens (~$107M) plus ~2.4B locked. Sun sued, alleging an undisclosed admin 'blacklist backdoor'; WLFI denied it and threatened a countersuit. The dispute is ongoing.
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
This page was last updated on Jun 15, 2026. View revision history.
