The gaming and NFT worlds collided with a harsh lesson in December 2021: even the most polished projects can be brought down by a security flaw, and when that happens, users pay the price. Vulcan Forged, a gaming and NFT platform with a growing community, found itself at the center of one of the biggest exploits of the year, and the story is a masterclass in both what went wrong and how a company should respond.
Vulcan Forged was hacked, and its customers ended up about $140 million poorer. A hacker exploited the Polygon-based platform to get hold of the private keys to ninety-six crypto wallets and grab 4.5 million PYR tokens.
💥 What Happened
The attack did not break the blockchain; the blockchain worked exactly as designed. The breach happened in the layer between users and the chain, the wallet infrastructure, and that is the layer that matters most. According to Jamie Thomson, the CEO of the company, “What’s happened is someone’s exploited our servers, got the Venly credentials, and used it to extract the private keys of the MyForge users.”
MyForge is an asset management tool that displays users’ crypto and NFT holdings, and it had been holding something much more valuable than a dashboard: access to the keys themselves. One compromised set of credentials, and ninety-six wallets were drained.
💬 The CEO’s Account
The human side of the hack came through loud and clear. Thomson recorded a video message the same day, and the company posted it with a simple caption:
A video message from CEO Jamie Thomson on today’s hack. pic.twitter.com/ivW5EjVrhm
~ Vulcan Forged (@VulcanForged) December 13, 2021
Speaking directly to the community within hours of the attack, rather than disappearing behind a PR team, is exactly the right way to handle a crisis like this. Users want to hear from the person in charge, and when the person in charge sounds shaken and determined at the same time, it rebuilds trust faster than any press release.
🔄 The Response
The company has vowed to make affected users whole with money from its treasury and claimed that half of the stolen funds had already been repaid. That commitment matters: a platform that reimburses victims is a platform that understands its users are the business.
Due to the hack, the company vowed to transition to decentralized wallets for greater security. It is the right lesson, learned the expensive way: when a platform controls private keys, it becomes the single point of failure. Moving key custody back to users means no server credentials, no matter how badly one is compromised, can drain a wallet again.
🧠 Final Thoughts
There are two ways to read this story. The pessimistic one: another platform hacked, another $140 million gone, and the reminder that crypto still has a security problem in its middle layer. The optimistic one: the company owned the mistake, reimbursed users, and started fixing the root cause within days.
The real takeaway for every reader is simpler. If your assets are held by a platform, your security is only as good as their servers. Hardware wallets, self custody, and a healthy distrust of anything labeled “asset management tool” are not paranoia, they are the standard. Thanks for reading.