Vulcan Forged Hack 2021 — $140M Exploit Analysis

Attackers compromised private keys for 96 Vulcan Forged user wallets through a breach of the platform's centralized key storage.

Details

• Date: 2021-12-13
• Amount Lost: $140,000,000
• Chain(s): Ethereum, Polygon
• Category: DeFi
• Technique: Private Key Compromise
• Status: Fully Recovered
• Amount Recovered: $140,000,000

Full Description

Vulcan Forged's semi-custodial wallet system stored private keys on centralized servers. Attackers breached the server and extracted private keys for 96 wallets, then systematically drained each one. The centralized key management was a fundamental architectural flaw — users believed they held self-custody but keys were server-side.

Laundering Analysis

Stolen PYR immediately sold on decentralized exchanges, crashing the price. ETH proceeds moved to Tornado Cash. Vulcan Forged CEO Jamie Thomson pledged personal funds and company treasury to compensate users, reimbursing $140M from treasury. Users migrated to fully self-custodial wallets post-incident.

Sources

• https://medium.com/vulcan-forged/vulcan-forged-wallet-restoration-plan-cfa6c5745d33
• https://rekt.news/vulcan-forged-rekt/

Transaction Hashes

• 0xb7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c

Related Hacks

• Euler Finance — 2023-03-13 — $197M
• Beanstalk Farms — 2022-04-17 — $182M
• Wintermute — 2022-09-20 — $160M
• Cream Finance — 2021-10-27 — $130M
• Compound — 2021-09-30 — $80M

Back to Browse