October 2021 Twitch source code, earnings hack explained

Twitch, the streaming service owned by Amazon, has been subject to an unprecedented hack. On the morning of Oct. 6, an anonymous 4chan user published a 235 GB torrent file that included Twitch’s source code, creator earnings details, and other confidential information.

This leak appears not to have included personal information of Twitch streamers or viewers like usernames or passwords. A lot of what was published is internal Twitch documentation. Twitch says that it’s still working to understand the scale of what was stolen, and that the company will update streamers and Twitch community members with more information when it’s available. Here’s what we know right now.

Was there anything stolen from the Twitch breach

The leaked information shared on Wednesday includes three years’ worth of creator earnings payouts, going back to 2019. These data include the top 10,000 streamers. Streamers have shared their confirmations on social media that the numbers correspond to their Twitch analytics. However, some streamers claim their numbers may be off.

Hackers also say they’ve got access to “commit history going back to [Twitch.tv’s] early beginnings,” which means that there could be saved “snapshots” of each iteration of Twitch as far back as its creation. Source code, too, for Twitch’s mobile, desktop, and console clients has also been made available online, as has “code related to proprietary SDKs and internal AWS services used by Twitch,” according to The Verge. Other Twitch properties such as the video game database IGBD, mod management system CurseForge and the gaming platform Steam, have also been exposed. Security tools, files and security information related to an allegedly in-development Steam competitor, codenamed Vapor and designed by Amazon Game Studios, were also leaked.

According to Vice, information shared in the leak is not particularly “sensitive,” at least to Twitch; the information shared is more harmful to streamers themselves.

As reported by The Verge, the information published Wednesday is labeled “part one,” which implies that more hacked data may be available. Twitch has not yet commented specifically on the data that’s been stolen.

Do I need to change my password then?

The short answer here is yes, you should change your password, even if there is little evidence suggesting that personal Twitch account information — aside from creator earnings — has been compromised. It’s possible that the Twitch hacker has more information, however, that could include personal information, including passwords and other sensitive data.

Twitch is not addressing user safety. Twitch users log in to the streaming site Wednesday and are asked for their password changes. It’s also generally recommended to enable two-factor authentication if you haven’t already — this step will make it harder for others to gain unauthorized access to your account, thus protecting any information in there.

Why are creators important?

Twitch streamers who earn money from the platform are largely secretive about how much they make, and that’s because anyone who has signed a contract with Twitch is reportedly barred from sharing that dataYou can find out more at. It’s no secret that Twitch streamers make money through a variety of avenues, including subscriptions, donations, ads, and exclusive contracts. Curious parties Can just add up the number of subscribers a person has to ballpark a streamer’s revenue in that area: Subscriptions start at $4.99 and revenue is split with Twitch. Twitch allows streamers to take a cut at 50% of subscription prices, however some streamers can negotiate other splits.

This list of creator incomes is important because it’s a new type of data that has not been previously uncovered at such a large scale. Among other things, the information here shows a major disparity between Twitch’s top streamers and the tens of thousands of streamers who struggle to find an audience. The breach has also sparked conversations about Twitch’s donation structure, which encourages viewers to “tip” streamers beyond their monthly subscription.

However, it’s not entirely clear what encompasses these numbers. The Washington Post reported Wednesday that the leaked earnings data appears to be a “composite of money made off ads, subscriptions, and other features,” — leaving out any brand deals, YouTube earnings, merchandise, or donations made outside of Twitch. These numbers are the untaxed earnings since 2019.

As part of these earnings documents, Critical Role is the most prominent channel. Dungeon & Dragons It is a role-playing channel that allows professional voice actors to participate in a campaign. It was founded by Overwatch voice actor Matthew Mercer. The second highest earner, per these leaked documents, is Félix “xQc” Lengyel, a controversial Canadian streamer and former Overwatch pro player. According to these documents, 81 streamers earned more than $1,000,000 from Twitch between 2019 and 2019, while the 10 highest earners of Twitch received, on average, $49,993,651 over those three years.

The earnings report, per the unconfirmed document, also highlights disparities in Twitch’s gender pay gap. The majority of the streamers listed within the top 100 are men; only three creators listed there are women — only one of whom is a woman of color, Kotaku reported Wednesday.

What are the reactions of streamers?

The Twitch Hack is an important topic on Twitch. Plenty of top streamers have opted to discuss payout earnings on streams throughout the day, many of which are poking fun at the money rankings: For instance, political commentator and streamer Hasan “HasanAbi” Piker titled his stream “#13 WEALTHIEST STREAMER ON THE PLANET,” commenting on his place on the earnings list to more than 44,000 viewers. Imane “Pokimane” Anys, streaming to more than 20,000 viewers, titled her stream in a similar way: “#39 reporting for duty” and joking on Twitter that “at least people can’t over-exaggerate me ‘making millions a month off my viewers anymore.’”

She continued: “I capped my donations a year ago since I’m not at a point where sponsors, investments, and exclusive contracts can sustain me. Transparently, subs + stream ads are the lowest part of my income and I want you guys to continue keeping that money in your pocket.”

The anonymous leaker, in the 4chan post with the hacked information, called Twitch’s community “a disgusting toxic cesspool,” and said the leak is intended to “foster more disruption and competition in the online video streaming space.” The leaker closed the message with a hashtag, #TwitchDoBetter, a reference to a social media campaign started in August designed to highlight harassment Black streamers face on the platform.

Some streamers vented their frustration at the leaker who used the hashtag #TwitchDoBetter. The hashtag was created in August in response to an increase in “hate raids” on the platform. Hate raiders misuse Twitch’s raiding feature — which lets a streamer migrate their viewers over to another stream — and send large amounts of toxic viewers or bots to marginalized streamers, especially, Black streamers, queer streamers, women streamers, and streamers of color. Twitch sued two individuals for leading hate attacks. Twitch also announced some new features in September to combat harassment. One feature requires Twitch viewers verify their phone number to be able to access chat functionality.

It is not an exaggeration to say that there is tension between Twitch streamers, and the company. Streamers are frustrated by a perceived lack of responsibility and security from the company — particularly its lack of protections for marginalized streamers — and Wednesday’s hack only adds to that existing frustration.