{"investigation":{"slug":"vulcan-forged","entity_name":"Vulcan Forged","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Vulcan Forged is a UK-based blockchain gaming studio and NFT marketplace operating on Polygon and its own Elysium Layer-1 blockchain, best known for VulcanVerse and its native PYR token. In December 2021 the platform suffered one of the largest gaming-sector hacks on record: an attacker exploited Vulcan Forged's servers to extract private keys from 96 semi-custodial wallets, stealing approximately 4.5 million PYR tokens then valued at roughly $140 million. The platform subsequently refunded affected users from its treasury and pledged to migrate to non-custodial wallets, but the incident exposed fundamental centralization and custodial risks in its architecture.","sections":[{"content":"Vulcan Forged is a blockchain gaming studio, NFT marketplace, and dApp incubator founded and led by CEO Jamie Thomson, who holds a Master's degree in Education and Artificial Intelligence from the University of Sussex. The project is headquartered in Greece and grew from a small NFT art site to a studio of over 130 employees by 2022. Its flagship product is VulcanVerse, a Greco-Roman fantasy MMORPG featuring 10,000 NFT land plots. The ecosystem's primary utility token is PYR, which is used for marketplace fees, staking, game-asset upgrades, and governance. A secondary in-game currency, LAVA (planned to rebrand as ELY), is earned through gameplay. The platform launched the Elysium testnet in January 2022 and completed a migration to the Elysium Layer-1 blockchain by 2023. In September 2022 Vulcan Forged raised $8 million in a Series A round led by SkyBridge Capital.","heading":"Overview","sources":[{"url":"https://cryptonews.com/exclusives/jamie-thomson-ceo-of-vulcan-forged-on-the-future-of-blockchain-gaming-and-growing-a-company-from-1-120-employees-ep-205/","name":"cryptonews.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2022/09/21/play-to-earn-gaming-platform-vulcan-forged-raises-8m-in-series-a-funding","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/what-is-vulcan-forged-pyr-and-how-to-make-money-playing-it","name":"cointelegraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On December 12-13, 2021, an attacker compromised Vulcan Forged's servers and extracted the private keys of 96 semi-custodial MyForge wallets, stealing approximately 4.5 million PYR tokens (representing roughly 9% of the total 50 million token supply, and approximately 23.7% of circulating supply) then valued at approximately $140 million. ETH and MATIC holdings in the affected wallets were also stolen. This remains one of the largest thefts in blockchain gaming history. The attack vector was not a direct breach of Vulcan Forged's wallet provider, Venly (formerly Arkane Network), but rather a server-level exploit on Vulcan Forged's own infrastructure. CEO Jamie Thomson stated: 'Someone exploited our servers, got the Venly credentials, and used it to extract the private keys of the MyForge users.' Venly confirmed that all export network calls originated from Vulcan Forged's IP addresses, making the requests appear legitimate from Venly's perspective. The attacker intercepted user PINs and used Vulcan Forged's Venly credentials to export wallets. The 96 affected wallets averaged approximately $1.46 million stolen per wallet, indicating that predominantly high-value accounts were targeted. PYR dropped over 30% in the 24 hours following the disclosure, falling from approximately $32 to below $21, with the project's market capitalization declining from roughly $612 million to $397 million. Vulcan Forged refunded the affected users from its treasury in PYR and LAVA within approximately 24 hours, and pledged to transition the entire ecosystem to non-custodial wallets to prevent recurrence.","heading":"December 2021 Private Key Compromise ($140M Hack)","sources":[{"url":"https://www.theblock.co/post/127270/96-private-keys-stolen-from-vulcan-forged-in-140-million-theft","name":"theblock.co","type":"other","credibility":3},{"url":"https://decrypt.co/88177/hacker-steals-140-million-polygon-gaming-platform-nft-marketplace-vulcan-forged","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.venly.io/blog/venly-informs-of-vulcan-forged-hack-with-at-least-96-vulcan-forged-wallets-affected","name":"venly.io","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2021/12/14/gaming-platform-vulcan-forged-refunds-users-after-140m-hack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://forkast.news/headlines/vulcan-forged-replaces-token-stolen-hack/","name":"forkast.news","type":"other","credibility":3}],"severity":"medium"},{"content":"The December 2021 hack directly resulted from Vulcan Forged's use of a semi-custodial wallet model, in which user private keys were managed server-side through a third-party provider (Venly). This architecture contradicts core Web3 security principles of user-controlled key custody. Users who held assets through the MyForge portal did not have direct custody of their private keys, creating a single point of failure that the attacker exploited. Following the incident, the platform committed to migrating to fully decentralized, non-custodial wallets. Independent security assessments have raised additional concerns: a CertiK Skynet audit completed February 10, 2023 identified 'Extreme' token concentration with 81.51% of PYR supply held by just three major addresses. The centralization scan also flagged proxy contracts, external call risks, mint functions, and owner privilege issues in the smart contracts. Additionally, only 27.49% of the codebase had been audited as of the CertiK assessment. The CertiK Skynet page notes the team was 'Not Verified By CertiK' and there is no active bug bounty program through CertiK or third parties.","heading":"Custodial Architecture and Centralization Risk","sources":[{"url":"https://skynet.certik.com/projects/vulcanforged","name":"skynet.certik.com","type":"other","credibility":3},{"url":"https://dappradar.com/blog/vulcan-forged-ecosystem-learns-valuable-lessons-in-recent-hack","name":"dappradar.com","type":"other","credibility":3},{"url":"https://www.venly.io/blog/venly-informs-of-vulcan-forged-hack-with-at-least-96-vulcan-forged-wallets-affected","name":"venly.io","type":"other","credibility":3}],"severity":"medium"},{"content":"PYR reached its all-time high of approximately $41.72 on November 30, 2021, just weeks before the December 2021 hack. Following the exploit and subsequent broader crypto market downturn, PYR declined sharply: in 2022 it fell from approximately $18.70 at the start of the year to $2.69 by year end, a decline of roughly 81.8%. The token briefly recovered during the 2023-2024 market cycle, reaching a secondary high of approximately $10.79 in March 2024, before declining again to approximately $0.78 in June 2025. As of May 2026, PYR is trading at approximately $0.26, a decline of over 99% from its all-time high. KuCoin removed margin trading access for PYR as of November 25, 2025. The extreme decline in token value, combined with the circulating supply shock from the hack (which temporarily flooded the market with 4.5 million tokens before the attacker's holdings were tracked), significantly damaged investor confidence.","heading":"Token Price Decline and Market Performance","sources":[{"url":"https://www.coingecko.com/en/coins/vulcan-forged","name":"coingecko.com","type":"other","credibility":3},{"url":"https://coincodex.com/crypto/vulcan-forged/","name":"coincodex.com","type":"other","credibility":3},{"url":"https://decrypt.co/88177/hacker-steals-140-million-polygon-gaming-platform-nft-marketplace-vulcan-forged","name":"decrypt.co","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the December 2021 hack, Vulcan Forged undertook several remediation steps. The team refunded approximately $140 million worth of PYR and LAVA tokens to affected users from the project treasury within roughly 24 hours of the breach disclosure, which was broadly acknowledged as a positive response. The platform announced a transition away from semi-custodial (Venly-based) wallets toward non-custodial solutions. The smart contracts were re-audited, with a new audit delivered by CertiK on February 10, 2023, which found zero critical, major, medium, minor, or informational findings in the code reviewed. In September 2022, Vulcan Forged raised $8 million in a Series A funding round led by SkyBridge Capital, with an option to invest an additional $33 million, indicating continued institutional interest despite the hack. The team launched the Elysium Layer-1 blockchain (testnet January 2022, mainnet migration completed by mid-2023) as part of its longer-term infrastructure development.","heading":"Post-Hack Recovery Measures","sources":[{"url":"https://www.coindesk.com/business/2021/12/14/gaming-platform-vulcan-forged-refunds-users-after-140m-hack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://forkast.news/headlines/vulcan-forged-replaces-token-stolen-hack/","name":"forkast.news","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2022/09/21/play-to-earn-gaming-platform-vulcan-forged-raises-8m-in-series-a-funding","name":"coindesk.com","type":"other","credibility":3},{"url":"https://skynet.certik.com/projects/vulcanforged","name":"skynet.certik.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/vulcan-forged-pyr-rallies-after-virtual-land-sales-and-the-elysium-testnet-launch","name":"cointelegraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Several structural risk factors remain relevant as of 2026. First, the project's CertiK assessment flags an extreme token concentration (81.51% of PYR held by 3 addresses), which poses significant price manipulation and liquidity risk for retail participants. Second, only 27.49% of the total codebase has been independently audited, leaving a majority of the code unverified. Third, the project has no disclosed bug bounty program, limiting external security research incentives. Fourth, the PYR token has declined over 99% from its all-time high, raising questions about long-term ecosystem viability and team treasury health — since the treasury was used for victim refunds in 2021, its current depth is unclear from public sources. Fifth, the planned rebrand of LAVA to ELY and launch of a centralized exchange (VulcanX) introduce additional execution risk. The project's website now shows a 'Coming Soon' page as of early 2026, and broader activity metrics suggest significantly reduced user engagement compared to the 2021-2022 peak. ZachXBT, the pseudonymous on-chain investigator, has flagged Vulcan Forged in the context of the 2021 hack and associated risks.","heading":"Ongoing Risk Factors","sources":[{"url":"https://skynet.certik.com/projects/vulcanforged","name":"skynet.certik.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/vulcan-forged","name":"coingecko.com","type":"other","credibility":3},{"url":"https://blog.vulcanforged.com/forge-on-into-2025-a-recap-and-looking-ahead/","name":"blog.vulcanforged.com","type":"other","credibility":3},{"url":"https://vulcanforged.com/Home/ComingSoon","name":"vulcanforged.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2019","event":"Vulcan Forged founded by Jamie Thomson as a small NFT art site, initially with two employees.","source":"","date_original":"2019-01-01"},{"date":"2021-05-14","event":"Vulcan Forged listed on CertiK Skynet for security monitoring.","source":""},{"date":"2021-11-30","event":"PYR token reaches all-time high of approximately $41.72.","source":""},{"date":"2021-12-12","event":"Attacker exploits Vulcan Forged servers, obtains Venly credentials, and extracts private keys from 96 MyForge semi-custodial wallets. Approximately 4.5 million PYR (~$140M), ETH, and MATIC are stolen. Venly confirms all export calls originated from Vulcan Forged's own IP address.","source":""},{"date":"2021-12-13","event":"Vulcan Forged publicly discloses the hack. CEO Jamie Thomson confirms the server exploit. PYR drops over 30% within 24 hours, market cap falls from ~$612M to ~$397M.","source":""},{"date":"2021-12-14","event":"Vulcan Forged refunds affected users with PYR and LAVA from the project treasury within approximately 24 hours of disclosure. Platform announces transition to non-custodial wallets.","source":""},{"date":"2022-01-28","event":"Elysium blockchain testnet launched, described as 'the blockchain for Metaverses.'","source":""},{"date":"2022-09-21","event":"Vulcan Forged raises $8 million in a Series A funding round led by SkyBridge Capital, with an option for an additional $33 million.","source":""},{"date":"2023-02-10","event":"CertiK completes a second audit of Vulcan Forged smart contracts, finding zero critical or high-severity findings in the reviewed code. Only 27.49% of codebase covered.","source":""},{"date":"2023-03-06","event":"New Elysium blockchain LAVA token airdropped to wallets following a snapshot from March 1, 2023.","source":""},{"date":"2024-03","event":"PYR reaches secondary high of approximately $10.79 during broader crypto market recovery.","source":"","date_original":"2024-03-01"},{"date":"2025-06","event":"PYR declines to approximately $0.78, representing a greater than 98% decline from all-time high.","source":"","date_original":"2025-06-01"},{"date":"2025-11-25","event":"KuCoin removes margin trading access for PYR.","source":""},{"date":"2026-05","event":"PYR trading at approximately $0.26, down over 99% from all-time high. Vulcan Forged main website shows 'Coming Soon' page.","source":"","date_original":"2026-05-01"}],"sources_used":[{"url":"https://cryptonews.com/exclusives/jamie-thomson-ceo-of-vulcan-forged-on-the-future-of-blockchain-gaming-and-growing-a-company-from-1-120-employees-ep-205/","name":"cryptonews.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/business/2022/09/21/play-to-earn-gaming-platform-vulcan-forged-raises-8m-in-series-a-funding","name":"coindesk.com","type":"other","archive_url":"https://web.archive.org/web/20260916004659/https://www.coindesk.com/business/2022/09/21/play-to-earn-gaming-platform-vulcan-forged-raises-8m-in-series-a-funding","credibility":3,"archive_timestamp":"2026-09-16T00:46:59+00:00"},{"url":"https://cointelegraph.com/news/what-is-vulcan-forged-pyr-and-how-to-make-money-playing-it","name":"cointelegraph.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/127270/96-private-keys-stolen-from-vulcan-forged-in-140-million-theft","name":"theblock.co","type":"other","archive_url":"http://web.archive.org/web/20260719162231/https://www.theblock.co/post/127270/96-private-keys-stolen-from-vulcan-forged-in-140-million-theft","credibility":3,"archive_timestamp":"2026-07-19T16:22:31+00:00"},{"url":"https://decrypt.co/88177/hacker-steals-140-million-polygon-gaming-platform-nft-marketplace-vulcan-forged","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260423033325/https://decrypt.co/88177/hacker-steals-140-million-polygon-gaming-platform-nft-marketplace-vulcan-forged","credibility":3,"archive_timestamp":"2026-04-23T03:33:25+00:00"},{"url":"https://www.venly.io/blog/venly-informs-of-vulcan-forged-hack-with-at-least-96-vulcan-forged-wallets-affected","name":"venly.io","type":"other","archive_url":"http://web.archive.org/web/20260316092529/https://www.venly.io/blog/venly-informs-of-vulcan-forged-hack-with-at-least-96-vulcan-forged-wallets-affected","credibility":3,"archive_timestamp":"2026-03-16T09:25:29+00:00"},{"url":"https://www.coindesk.com/business/2021/12/14/gaming-platform-vulcan-forged-refunds-users-after-140m-hack","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20250906132716/https://www.coindesk.com/business/2021/12/14/gaming-platform-vulcan-forged-refunds-users-after-140m-hack","credibility":3,"archive_timestamp":"2025-09-06T13:27:16+00:00"},{"url":"https://forkast.news/headlines/vulcan-forged-replaces-token-stolen-hack/","name":"forkast.news","type":"other","archive_url":"https://web.archive.org/web/20260830085519/https://forkast.news/vulcan-forged-replaces-token-stolen-hack/","credibility":3,"archive_timestamp":"2026-08-30T08:55:19+00:00"},{"url":"https://skynet.certik.com/projects/vulcanforged","name":"skynet.certik.com","type":"other","archive_url":"http://web.archive.org/web/20260416084902/https://skynet.certik.com/projects/vulcanforged","credibility":3,"archive_timestamp":"2026-04-16T08:49:02+00:00"},{"url":"https://dappradar.com/blog/vulcan-forged-ecosystem-learns-valuable-lessons-in-recent-hack","name":"dappradar.com","type":"other","archive_url":"https://web.archive.org/web/20260830084838/https://dappradar.com/blog/vulcan-forged-ecosystem-learns-valuable-lessons-in-recent-hack","credibility":3,"archive_timestamp":"2026-08-30T08:48:38+00:00"},{"url":"https://www.coingecko.com/en/coins/vulcan-forged","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20260706185447/https://www.coingecko.com/en/coins/vulcan-forged","credibility":3,"archive_timestamp":"2026-07-06T18:54:47+00:00"},{"url":"https://coincodex.com/crypto/vulcan-forged/","name":"coincodex.com","type":"other","archive_url":"http://web.archive.org/web/20260609141739/https://coincodex.com/crypto/vulcan-forged/","credibility":3,"archive_timestamp":"2026-06-09T14:17:39+00:00"},{"url":"https://cointelegraph.com/news/vulcan-forged-pyr-rallies-after-virtual-land-sales-and-the-elysium-testnet-launch","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260115060132/https://cointelegraph.com/news/vulcan-forged-pyr-rallies-after-virtual-land-sales-and-the-elysium-testnet-launch","credibility":3,"archive_timestamp":"2026-01-15T06:01:32+00:00"},{"url":"https://blog.vulcanforged.com/forge-on-into-2025-a-recap-and-looking-ahead/","name":"blog.vulcanforged.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://vulcanforged.com/Home/ComingSoon","name":"vulcanforged.com","type":"other","archive_url":"https://web.archive.org/web/20260829200110/https://vulcan-x.io/Home/ComingSoon","credibility":3,"archive_timestamp":"2026-08-29T20:01:10+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-5","created_at":"2026-05-04T02:54:52.454004+00:00","updated_at":"2026-09-16T00:50:16.893437+00:00"}}