Fourth Hack in Ten Days Hits Vulcan Forged as $140M in PYR Drained

In the span of just ten days, the crypto industry logged four separate security incidents totaling roughly $415 million in losses. BitMart lost $196 million, 8ight Finance lost $1.75 million, AscendEX lost $77.7 million, and now Vulcan Forged joins the list with roughly $140 million siphoned from user wallets. In each case, the explanation offered was some variation of compromised private keys.

Vulcan Forged describes itself as a blockchain game studio and NFT marketplace, best known for its fantasy play-to-earn titles built around the VulcanVerse ecosystem. Most of what the attacker took was denominated in the platform's native token, $PYR, which underpins in-game purchases and marketplace activity.

To support these features, Vulcan Forged links each user account to an integrated wallet supplied by third-party provider Venly. It was the private keys behind 96 of these addresses that ended up compromised, giving the attacker a path to empty them. Beyond $PYR, affected users also saw meaningful amounts of ETH and MATIC disappear from their accounts.

The perpetrator's address has been identified on two networks:

Ethereum

Polygon

From there, the stolen funds moved onward to additional wallets. One such destination, visible here, currently holds approximately $40 million in $PYR alongside roughly $600,000 in ETH. The Vulcan Forged team has said it believes it has traced one address to an exchange with KYC requirements in place.

In total, more than 4.5 million PYR tokens were extracted, valued at approximately $140 million at the time of the exploit. As the stolen tokens hit the market, the sell pressure pushed the PYR price down about 30% from around $31 to a low of $21.47.

Unlike the other incidents in this recent cluster, Vulcan Forged moved quickly to address the breach publicly. The team responded within hours and has continued issuing updates via Twitter, committing to reimburse the stolen PYR and to phase out custodial wallets altogether. Per the most recent update, most of the impacted wallets have already been made whole using treasury funds, and the team says it intends to move toward a fully decentralized architecture going forward.

Even so, a faster-than-average response doesn't fully answer the underlying questions. Claims of "compromised keys" are essentially unverifiable by anyone outside the organization, which conveniently shields those closest to the incident from scrutiny. Whether the fault lies with Vulcan Forged's own security practices or with Venly as the wallet infrastructure provider remains unclear — and without more transparency from either party, it's likely to stay that way.