{"investigation":{"slug":"audius","entity_name":"Audius","trust_score":58,"severity_base":null,"score_modifier":26,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Audius is a decentralized music streaming protocol and its native AUDIO token, launched in 2020 on Ethereum and subsequently migrated to Solana. On July 23, 2022, an attacker exploited a critical re-initialization vulnerability in Audius governance smart contracts, draining 18.56 million AUDIO tokens (valued at approximately $6 million at the time) from the community treasury before swapping them for approximately $1.08 million in ETH via Uniswap and routing funds through Tornado Cash. The platform has continued to operate since the exploit, deploying patched contracts and expanding user and artist partnerships, but the AUDIO token has declined approximately 99.6% from its all-time high and the exploit raised serious questions about audit quality.","sections":[{"content":"On July 23, 2022, an unidentified attacker exploited a critical vulnerability in Audius' Ethereum-based governance, staking, and delegation smart contracts. The root cause was a storage collision bug introduced during a prior contract upgrade: when the proxy contract read the 'initialized' flag, it instead returned the value of a newly added 'proxyAdmin' variable, allowing the attacker to call the initialize() function repeatedly on already-deployed contracts. The attacker leveraged this to designate themselves as the sole guardian of the governance contract and self-delegate 10 trillion AUDIO tokens — far exceeding the legitimate circulating supply of approximately 725 million tokens. Using this fabricated voting power, the attacker passed a malicious governance proposal transferring 18,564,497 AUDIO tokens from the community treasury to their own wallet. The attacker's first attempt (creating erroneous token delegation) occurred at approximately 22:54 UTC; a second successful proposal passed at 23:10 UTC. The stolen tokens were then swapped for approximately 704.17 ETH (worth roughly $1.08–1.09 million at the time) via Uniswap due to significant price impact, with proceeds routed through Tornado Cash at address 0xa0c7bd318d69424603cbf91e9969870f21b8ab4 to obscure the trail. The Audius team assembled a response team within 25 minutes, identified the root cause within one hour, and deployed an initial fix 87 minutes after detecting the exploit — using the same vulnerability to regain governance control and freeze staking and delegation contracts. A key on-chain transaction associated with the exploit carries hash 0x82fc23992c7433fffad0e28a1b8d11211dc4377de83e88088d79f24f4a3f28b3. No recovery of stolen funds was reported.","heading":"July 2022 Governance Exploit","sources":[{"url":"https://cryptoslate.com/attackers-stole-6-million-from-audius-by-exploiting-a-bug-in-the-contract/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/hacker-drains-1-08m-from-audius-following-passing-of-malicious-proposal","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://losslessdefi.medium.com/audius-hack-code-enabled-governance-attack-33ac9d8084c8","name":"losslessdefi.medium.com","type":"other","credibility":3},{"url":"https://www.bankinfosecurity.com/thief-steals-6m-tokens-from-audius-sells-them-for-1m-a-19639","name":"bankinfosecurity.com","type":"other","credibility":3},{"url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/hacker-exploits-bug-at-decentralized-music-platform-audius-steals-6-million-worth-of-tokens","name":"bitdefender.com","type":"other","credibility":3},{"url":"https://dailycoin.com/music-platform-audius-audio-hacked-for-6m-via-proposal-exploit/","name":"dailycoin.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The exploited Audius governance contracts were originally deployed in October 2020 and had been audited by OpenZeppelin (August 2020), Kudelski Security (October 2021), and allegedly reviewed by PeckShield, none of which identified the re-initialization vulnerability. The flaw existed in production for nearly two years before it was exploited. The case became widely cited in the security community as evidence that smart contract audits are not sufficient guarantees of safety, particularly for upgradeable proxy patterns where storage layout collisions can introduce critical vulnerabilities during upgrades. The Audius team acknowledged that the core development team had not actively worked on Solidity/EVM code for approximately two years before the exploit, which contributed to response delays. A proof-of-concept exploit was later published on GitHub by independent researchers.","heading":"Audit Failures and Smart Contract Security","sources":[{"url":"https://cryptonews.net/news/security/9578753/","name":"cryptonews.net","type":"other","credibility":3},{"url":"https://losslessdefi.medium.com/audius-hack-code-enabled-governance-attack-33ac9d8084c8","name":"losslessdefi.medium.com","type":"other","credibility":3},{"url":"https://github.com/nukanoto/audius-exploit","name":"github.com","type":"other","credibility":3},{"url":"https://hashdex.com/en-US/insights/three-lessons-from-the-audius-hack","name":"hashdex.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The AUDIO token was listed following the mainnet launch in September 2020 and reached an all-time high of approximately $4.95. The token declined approximately 92% in 2022, with the governance exploit in July 2022 contributing to a significant loss of market confidence. As of May 2026, AUDIO trades at approximately $0.019, approximately 99.6% below its all-time high. The current market capitalization is approximately $27.6 million on a circulating supply of roughly 1.42 billion tokens. The AUDIO price briefly recovered in early 2023 before declining again. The token experienced a brief surge of over 90% following the August 2021 TikTok partnership announcement, illustrating strong sensitivity to partnership news.","heading":"Token Performance and Market Impact","sources":[{"url":"https://coinmarketcap.com/currencies/audius/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/audius","name":"coingecko.com","type":"other","credibility":3},{"url":"https://www.cnbc.com/2021/08/17/audius-lands-tiktok-partnership-and-its-token-audio-market-cap-surged.html","name":"cnbc.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Audius was founded in 2018 by Roneil Rumburg (CEO), Forrest Browning (CPO), and musician/entrepreneur Ranidu Lankage. The concept originated around 2015 as a proposed community-owned alternative to SoundCloud. Audius raised a total of approximately $16.1 million across five funding rounds, with the largest being a $5.5 million Series A in August 2018 led by General Catalyst. Additional institutional investors include Lightspeed Venture Partners and Blockchange. Artist investors include Katy Perry, Nas, Jason Derulo, The Chainsmokers (via Mantis VC), Steve Aoki, Pusha T, Linkin Park's Mike Shinoda, and Disclosure. The platform launched a testnet in August 2019, the mainnet and AUDIO token in September 2020, and surpassed 500,000 monthly active users by August 2020. Audius acquired the virtual concert platform SoundStage.fm in 2022.","heading":"Background and Founding","sources":[{"url":"https://www.rollingstone.com/pro/news/audius-blockchain-nft-crypto-streaming-platform-1226559/","name":"rollingstone.com","type":"other","credibility":3},{"url":"https://www.crunchbase.com/organization/audius","name":"crunchbase.com","type":"other","credibility":3},{"url":"https://forkast.news/what-is-audius-could-it-be-the-next-spotify/","name":"forkast.news","type":"other","credibility":3}],"severity":"medium"},{"content":"In August 2021, Audius announced a partnership with TikTok as the platform's first music streaming integration, enabling artists to push tracks directly from Audius to TikTok Sounds. This was described as the first such music streaming integration TikTok had established with any blockchain-based platform. As of early 2026, Audius reports approximately 7.5–8 million monthly active users and has continued to expand its product with features including USDC-based direct artist payments, artist-issued tokens, and integrations with music marketing platforms. The protocol operates primarily on Solana for its content and social layer, with legacy Ethereum contracts for staking and governance following the 2022 exploit remediation. An airdrop phishing campaign impersonating Audius was reported in 2026, with Audius officially warning users that no official airdrop had been announced.","heading":"Platform Operations and Partnerships","sources":[{"url":"https://www.cnbc.com/2021/08/17/audius-lands-tiktok-partnership-and-its-token-audio-market-cap-surged.html","name":"cnbc.com","type":"other","credibility":3},{"url":"https://www.rollingstone.com/pro/news/tiktok-sounds-streaming-crypto-blockchain-nfts-audius-1211699/","name":"rollingstone.com","type":"other","credibility":3},{"url":"https://routenote.com/blog/audius-tops-7-5-million-users-after-acquiring-soundstage-fm/","name":"routenote.com","type":"other","credibility":3},{"url":"https://x.com/audius/status/1968485999933034944","name":"x.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the July 2022 exploit, the attacker routed stolen proceeds through Tornado Cash, the Ethereum-based cryptocurrency mixer sanctioned by the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) on August 8, 2022 — just over two weeks after the Audius exploit. Tornado Cash was frequently used in 2022 to launder proceeds from major crypto exploits. The Audius exploit proceeds totaling approximately $1.08 million in ETH were reported to have passed through the mixer. The Tornado Cash protocol's co-founders were subsequently charged by the U.S. Department of Justice with money laundering and sanctions violations.","heading":"Fund Laundering via Tornado Cash","sources":[{"url":"https://home.treasury.gov/news/press-releases/jy0916","name":"home.treasury.gov","type":"other","credibility":3},{"url":"https://www.justice.gov/usao-sdny/pr/tornado-cash-founders-charged-money-laundering-and-sanctions-violations","name":"justice.gov","type":"other","credibility":3},{"url":"https://cryptoslate.com/attackers-stole-6-million-from-audius-by-exploiting-a-bug-in-the-contract/","name":"cryptoslate.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2018","event":"Audius founded by Roneil Rumburg, Forrest Browning, and Ranidu Lankage; raises $5.5M Series A from General Catalyst.","source":"","date_original":"2018-01-01"},{"date":"2019-08","event":"Audius testnet launched; independent node operators begin supporting the network.","source":"","date_original":"2019-08-01"},{"date":"2020-09","event":"Audius mainnet launches alongside the AUDIO token; platform reports over 500,000 monthly active users.","source":"","date_original":"2020-09-01"},{"date":"2020-10","event":"Governance, staking, and delegation smart contracts deployed on Ethereum mainnet; audited by OpenZeppelin.","source":"","date_original":"2020-10-01"},{"date":"2021-08-17","event":"Audius announces partnership with TikTok as its first music streaming integration; AUDIO token surges over 90%.","source":""},{"date":"2021-10","event":"Kudelski Security audits Audius smart contracts; re-initialization vulnerability goes undetected.","source":"","date_original":"2021-10-01"},{"date":"2022-07-23","event":"Governance exploit: attacker exploits storage collision bug, passes malicious governance proposal, drains 18,564,497 AUDIO (~$6M) from community treasury. Proceeds (~$1.08M ETH) swapped on Uniswap and laundered via Tornado Cash. Audius team deploys fix within 87 minutes.","source":""},{"date":"2022-08-08","event":"U.S. Treasury OFAC sanctions Tornado Cash, the mixer used by the Audius attacker to launder stolen proceeds.","source":""},{"date":"2022","event":"Audius acquires virtual concert platform SoundStage.fm; platform tops 7.5 million monthly users.","source":"","date_original":"2022-01-01"},{"date":"2023-08-23","event":"Tornado Cash co-founders charged by U.S. DOJ with money laundering and sanctions violations.","source":""},{"date":"2026-05","event":"AUDIO trading at approximately $0.019, approximately 99.6% below all-time high. Audius warns users of phishing airdrop campaign impersonating the platform.","source":"","date_original":"2026-05-01"}],"sources_used":[{"url":"https://cryptoslate.com/attackers-stole-6-million-from-audius-by-exploiting-a-bug-in-the-contract/","name":"cryptoslate.com","type":"other","archive_url":"https://web.archive.org/web/20260830042236/https://cryptoslate.com/attackers-stole-6-million-from-audius-by-exploiting-a-bug-in-the-contract/","credibility":3,"archive_timestamp":"2026-08-30T04:22:36+00:00"},{"url":"https://cointelegraph.com/news/hacker-drains-1-08m-from-audius-following-passing-of-malicious-proposal","name":"cointelegraph.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://losslessdefi.medium.com/audius-hack-code-enabled-governance-attack-33ac9d8084c8","name":"losslessdefi.medium.com","type":"other","archive_url":"http://web.archive.org/web/20250905120829/https://losslessdefi.medium.com/audius-hack-code-enabled-governance-attack-33ac9d8084c8","credibility":3,"archive_timestamp":"2025-09-05T12:08:29+00:00"},{"url":"https://www.bankinfosecurity.com/thief-steals-6m-tokens-from-audius-sells-them-for-1m-a-19639","name":"bankinfosecurity.com","type":"other","archive_url":"https://web.archive.org/web/20260830044500/https://www.bankinfosecurity.com/thief-steals-6m-tokens-from-audius-sells-them-for-1m-a-19639","credibility":3,"archive_timestamp":"2026-08-30T04:45:00+00:00"},{"url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/hacker-exploits-bug-at-decentralized-music-platform-audius-steals-6-million-worth-of-tokens","name":"bitdefender.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://dailycoin.com/music-platform-audius-audio-hacked-for-6m-via-proposal-exploit/","name":"dailycoin.com","type":"other","archive_url":"http://web.archive.org/web/20250913021839/https://dailycoin.com/music-platform-audius-audio-hacked-for-6m-via-proposal-exploit/","credibility":3,"archive_timestamp":"2025-09-13T02:18:39+00:00"},{"url":"https://cryptonews.net/news/security/9578753/","name":"cryptonews.net","type":"other","archive_url":"https://web.archive.org/web/20260829131803/https://cryptonews.net/news/security/9578753/","credibility":3,"archive_timestamp":"2026-08-29T13:18:03+00:00"},{"url":"https://github.com/nukanoto/audius-exploit","name":"github.com","type":"other","archive_url":"http://web.archive.org/web/20251103083633/https://github.com/nukanoto/audius-exploit","credibility":3,"archive_timestamp":"2025-11-03T08:36:33+00:00"},{"url":"https://hashdex.com/en-US/insights/three-lessons-from-the-audius-hack","name":"hashdex.com","type":"other","archive_url":"https://web.archive.org/web/20260830001251/https://hashdex.com/en-US/insights/three-lessons-from-the-audius-hack","credibility":3,"archive_timestamp":"2026-08-30T00:12:51+00:00"},{"url":"https://coinmarketcap.com/currencies/audius/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260725134912/https://coinmarketcap.com/currencies/audius/","credibility":3,"archive_timestamp":"2026-07-25T13:49:12+00:00"},{"url":"https://www.coingecko.com/en/coins/audius","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20251210140156/https://www.coingecko.com/en/coins/audius","credibility":3,"archive_timestamp":"2025-12-10T14:01:56+00:00"},{"url":"https://www.cnbc.com/2021/08/17/audius-lands-tiktok-partnership-and-its-token-audio-market-cap-surged.html","name":"cnbc.com","type":"other","archive_url":"https://web.archive.org/web/20260829145333/https://www.cnbc.com/2021/08/17/audius-lands-tiktok-partnership-and-its-token-audio-market-cap-surged.html","credibility":3,"archive_timestamp":"2026-08-29T14:53:33+00:00"},{"url":"https://www.rollingstone.com/pro/news/audius-blockchain-nft-crypto-streaming-platform-1226559/","name":"rollingstone.com","type":"other","archive_url":"http://web.archive.org/web/20260706121620/https://www.rollingstone.com/pro/news/audius-blockchain-nft-crypto-streaming-platform-1226559/","credibility":3,"archive_timestamp":"2026-07-06T12:16:20+00:00"},{"url":"https://www.crunchbase.com/organization/audius","name":"crunchbase.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://forkast.news/what-is-audius-could-it-be-the-next-spotify/","name":"forkast.news","type":"other","archive_url":"http://web.archive.org/web/20260612212232/https://forkast.news/what-is-audius-could-it-be-the-next-spotify/","credibility":3,"archive_timestamp":"2026-06-12T21:22:32+00:00"},{"url":"https://www.rollingstone.com/pro/news/tiktok-sounds-streaming-crypto-blockchain-nfts-audius-1211699/","name":"rollingstone.com","type":"other","archive_url":"http://web.archive.org/web/20260202001103/https://www.rollingstone.com/pro/news/tiktok-sounds-streaming-crypto-blockchain-nfts-audius-1211699/","credibility":3,"archive_timestamp":"2026-02-02T00:11:03+00:00"},{"url":"https://routenote.com/blog/audius-tops-7-5-million-users-after-acquiring-soundstage-fm/","name":"routenote.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://x.com/audius/status/1968485999933034944","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://home.treasury.gov/news/press-releases/jy0916","name":"home.treasury.gov","type":"other","archive_url":"http://web.archive.org/web/20260822123118/https://home.treasury.gov/news/press-releases/jy0916","credibility":3,"archive_timestamp":"2026-08-22T12:31:18+00:00"},{"url":"https://www.justice.gov/usao-sdny/pr/tornado-cash-founders-charged-money-laundering-and-sanctions-violations","name":"justice.gov","type":"other","archive_url":"http://web.archive.org/web/20260622124109/https://www.justice.gov/usao-sdny/pr/tornado-cash-founders-charged-money-laundering-and-sanctions-violations","credibility":3,"archive_timestamp":"2026-06-22T12:41:09+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:48.878275+00:00","updated_at":"2026-08-30T05:14:12.954851+00:00"}}