On July 23, an unidentified person withdrew nearly $6 million worth of digital assets from the treasury of decentralized streaming platform Audius. The attacker changed the smart contract configuration and started a malicious administration proposal.

Hello everyone – our team is aware of reports of unauthorized transfer of AUDIO tokens from the community treasury. We are actively investigating and will provide you with feedback as soon as we learn more.

If you would like to assist our response team, please contact us.

— Audius (@AudiusProject) July 24, 2022

“Our team is aware of the unauthorized transfer of AUDIO tokens from the community treasury. We are actively investigating the incident and will report the results of the investigation later,” he said.

According to CertiK, a security company, an unidentified person changed the platform’s smart contract configuration, allowing it to assign “trustee” status to its address and change the voting period.

After that, the attacker published a project management proposal involving the transfer of 18 million AUDIO to a third-party wallet and voted in his favour.

(1/2) The attacker called the “start” function in the Audius governance contract to change configurations (via reboot) such as “voting time”, “execution delay”, “parent address”.

Then the attacker sent the malicious offer (ID 85).

— CertiKAlert (@CertiKAlert) July 24, 2022

The market value of the assets stolen at the time of the attack was around $6 million, but due to the strong price slippage, the hacker sold them for 705 ETH (~$1.14 million). According to Etherscan, the attacker transferred funds to the address of the Tornado Cash mixer.

PeckShield analysts noted that an unknown person managed to gain access to the Audius treasure due to “inconsistencies” in certain elements of the project’s storage management system.

problem @AudiusProject lies in the inconsistent storage scheme between proxy and impl. Specifically, conflicting Audius Community Treasure contract results in the equivalent of disabling the launcher modifier. The proxyAdmin address (0x..abac) plays a role here. pic.twitter.com/x4CqRncahp

— Peck Shield Inc. (@peckshield) July 24, 2022

Audius developers suspended the platform’s smart contracts to prevent further loss of funds. July 24 team continued The operation of the SES contract.

Recall that in the second quarter of 2022, the total loss of crypto projects from hacking and fraud exceeded $ 670 million, according to Immunefi.

Read ForkLog bitcoin news in our Telegram – cryptocurrency news, courses and analysis.