Hackers steal $6 million from blockchain music platform Audius

guest · Jul 26, 2022

July 26, 2022

The decentralized music platform Audius was hacked over the weekend, with threat actors stealing over 18 million AUDIO tokens worth approximately $6 million.

Audius is a decentralized streaming platform hosted on the Ethereum blockchain where artists can earn AUDIO tokens by sharing their music, and users can earn tokens by curating and listening to content.
Click to expand...

After a hacker stole $6 million worth of AUDIO tokens this weekend, the platform responded within minutes by freezing several services until the developers could deploy fixes to prevent further theft of tokens.
According to a post-mortem report published by Audius on Sunday, the hacker exploited a bug in the contract initialization code that allowed them to perform repeated invocations of the initialize functions.

In the meantime, the attacker traded their tokens on Uniswap for only $1.07 million, losing 5/6 of their value, and then passed them through the Tornado Cash mixing service to hide the trail of the stolen funds.
Click to expand...

Exploited system was audited twice
Audius’ contract system has undergone two in-depth security assessments in August 2020 and October 2021 from two different auditors, but neither discovered the exploited vulnerability.

“Audits are not bulletproof, and time spent in the market (and the resulting Lindy effect) can help build confidence but does not rule out opportunities for exploitation,” comments Audius in the post-mortem.
Click to expand...

Audius Governance Takeover Post-Mortem 7/23/22

On July 23, 2022, the Audius governance, staking, and delegation contracts on Ethereum mainnet were compromised due to a bug in the contract initialization code that allowed repeated invocations of the initialize functions.

The bug allowed an attacker to maliciously transfer 18MM $AUDIO tokens held by the Audius governance contract (referred to as the “community treasury”) to a wallet of their control and modify dynamics of the voting system to illicitly change their staked $AUDIO amounts in the network.
The set of contracts were audited by the OpenZeppelin team [report] August 25, 2020 prior to deployment and some additional changes separate from the affected vulnerable code were audited by Kudelski on October 27, 2021 [report], but unfortunately this vulnerability was not caught in either case.
Click to expand...

Log in or Sign up

Hackers steal $6 million from blockchain music platform Audius

guest Guest

Log in or Sign up

Hackers steal $6 million from blockchain music platform Audius

guest Guest

Useful Searches