Hacker Stole 96 Private Keys From Vulcan Forged In $140 Million Theft
A hacker stole 96 private keys were from the crypto gaming ecosystem Vulcan Forged, enabling the attacker to steal $140 million in cryptocurrency.
Vulcan Forged offers a wide variety of crypto activities. Mainly known as a game studio, Vulcan Forged offers six different blockchain-based games, also has an NFT marketplace and its own decentralized exchange (DEX), where users can trade its token PYR.
When an account is registered with Vulcan Forged, the platform creates a set of blockchain wallets for them on the Ethereum, Polygon and VeChain blockchains, and manage the users’ private keys – on their behalf.
Vulcan Forged works with wallet management service Venly to create its wallets — a service also used by Atari, Matic and the Blockchain Game Alliance.
Venly CEO Tim Dierckxens commented on the exploit:
“Venly Servers or Solutions have not been compromised. The Venly team is actively helping the Vulcan Forged team with data analytics to help them understand and recover from this unfortunate event. Official communication will follow soon.”
The 96 wallets that were compromised contained 4.5 million PYR, worth $140 million at the time of the exploit.
4.5 million PYR is roughly 9% of the project’s total supply of tokens and 23.7% of the circulating supply.
Other assets including ether (ETH) and polygon (MATIC) may have also been taken.
For those that lost other assets too, including ETH, MATIC, as this was ultimately our responsibility we will also reimburse those assets in the equivalent of PYR.
After the exploit was discovered, Vulcan Forged told its community to remove funds from the liquidity pools on decentralized exchanges, before announcing the incident. This probably made it harder for the attacker to cash out the funds, without using centralized exchanges where they might need identity documents.
Regardless, the hacker sold significant amounts of PYR for ETH, selling small batches of tokens at a time. 2 million PYR (currently worth $47 million) still remains untouched in a wallet.
This incident has affected the price of PYR. It was at $31 prior to the attack and is now at $23.47 — down 24%.
According to Vulcan Forged the project’s treasury will send out PYR and Vulcan Forged’s LAVA tokens to those affected. They will need to set up accounts with MetaMask and will receive the tokens there. Anyone who had ETH or MATIC stolen will receive the equivalent amount in PYR.
We will send emails out to all Vulcan wallets affected today to get a metamask address from you.
We’ll replace your PYR and LAVA from our treasury.
We are removing the semi custodial solution from the entire Vulcan ecosystem.
Please give us today to get our heads around this.
“We have contacted all exchanges to blacklist that address. It also seems the wallet owner may have KYCd on an exchange we’re now in contact with,” tweeted Vulcan Forged.
It added that it is removing what it described as a semi-custodial solution from the Vulcan Forged ecosystem — meaning that in the future, its users will need to look after their own private keys.
According to Vulcan Forged all wallets have since been secured, and almost all PYR has been reimbursed.
All My Forge wallets have been secured. Only a few needing PYR back.
ETA for new wallet system: 2 days.
We’ll be conducting a buy back and burn once things have been settled.
We are emerging from this stronger and more secure. A valuable lesson.
