NFT marketplace Vulcan Forged compromised, $135M stolen

• Vulcan Forged has revealed that 148 wallets were compromised and 4.5 million PYR tokens stolen, worth $135 million at the time of the heist.
• The project pledged to pay back all the stolen funds from its treasury and said it’s working with exchanges to nail down the criminals behind the attack.

---

Yet another blockchain project has fallen victim to cybercriminals. Vulcan Forged, a blockchain gaming studio and NFT marketplace announced that 148 wallets were compromised, had their private keys stolen and their accounts drained. However, all the victims will be compensated by the project’s treasury even as stakeholders come together to pursue the suspects.

Vulcan Forged touts itself as an “easy-to-play and easy-to-build ecosystem” that supports blockchain gaming through development programs, incubation and crowdfunding. It hosts some fast-rising blockchain games in addition to being an NFT marketplace. Its native token is PYR which gamers use to make transactions on the network, but which is also traded on secondary markets, with Binance listing it just three weeks ago.

Vulcan Forged took to Twitter to announce the theft today, December 13. It revealed that over 4.5 million PYR tokens had been stolen. At the time of the theft, PYR was trading just above $30, putting the total stolen amount above $135 million.

148 wallets holding PYR have been compromised. Over 4.5m PYR has been been stolen.

While we will replace the PYR taken, our first steps are understanding what’s happened.

No words can do much right now, we know that. We’ll keep updated.

— Vulcan Forged (@VulcanForged) December 13, 2021

Vulcan Forged revealed that the criminals were able to access the private keys for the 148 victims, allowing them access to these wallets.

“We’re powerless in their removal of funds from wallets that have had their [private keys]stolen and funds not moved out,” the project stated.

It further claimed that it would be removing the ‘semi custodial solution’ it currently offers and would be moving to a completely decentralized wallet but failed to give the details.

Related: Hackers steal $196 million from Bitmart exchange exploiting hot wallets on Ethereum and BSC

Refunding victims and pursuing the criminals

The good news for all PYR holders is that the project will be fully refunding the stolen PYR tokens from its treasury. It added:

For those that lost other assets too, including ETH, MATIC, as this was ultimately our responsibility we will also reimburse those assets in the equivalent of PYR.

The victims were requested to send an email to [email protected] using the email address they registered on the platform with and include a Metamask address where they would like to receive their refunds.

The project is working to trace the funds and has contacted cryptocurrency exchanges seeking to have them block the address that was used in the heist. It further claimed that the wallet owner is likely to have given out his personal information as part of KYC for the exchange he uses and Vulcan Forged would be following this up. If the criminal did KYC on an exchange, he will be very easy to track down for the authorities.

And despite the security incident, the Vulcan Forged team is as strong-willed as ever and will keep its focus on the project’s goals, it concluded.

The way forward now:

1. PYR will be sent to users from treasury to replace stolen funds starting today.
2. ALL development continues. Always will.
3. Marketplace and infrastructure will move to decentralized wallets.
4. No goal has changed.

Please use Discord for updates.

— Vulcan Forged (@VulcanForged) December 13, 2021

The PYR token took an immediate hit once the hack was announced. Since then, it has lost about 25 percent to trade at $23 at press time.