Twitch acknowledges a “breach” after a 4chan user leaks its source code, creator payouts from 2019-2021, proprietary SDKs, internal AWS services, and more
The entire code based leaked online. Now what? Alex Calvin / PC Games Insider : Twitch confirms it has been the victim of a massive hack Nathan Grayson / Washington Post : Massive Twitch hack reveals streamers' pay, with top stars making millions Nivedita Balu / The Economic Times : Twitch hit by data breach, hacker leaks source code Chris Scullion / Video Games Chronicle : Twitch leak: Company confirms hack and says it's ‘working to understand’ Tweets: KnowSomething / @knows0mething : The gross payouts of the top 100 highest-paid Twitch streamers from August 2019 until October 2021: https://twitter.com/... Sinoc / @sinoc229 : https://twitch.tv/ got leaked. Like, the entire website; Source code with comments for the website and various console/phone versions, refrences to an unreleased steam competitor, payouts, encrypted passwords that kinda thing. Might wana change your passwords. Kevin Beaumont / @gossithedog : Twitch leak is real. Includes significant amount of personal data. Feel bad for the InfoSec team, the attacker leaked lots of their data too including their threat models (which they probably want to update to include 4chan). Sinoc / @sinoc229 : Grabbed Vapor, the codename for Amazon's Steam competitor. Seems to intigrate most of Twitch's features as well as a bunch of game specific support like fortnite and pubg. Also includes some Unity code for a game called Vapeworld, which I assume is some sort of VR chat thing. https://twitter.com/... KnowSomething / @knows0mething : Twitch has just had a major leak of a lot of stuff including their monthly payouts to streamers. Here are some of the notables (note: this total is just their payout directly from twitch, so it doesn't include donations, sponsors, merch, etc.) https://twitter.com/... Scott Hellyer / @tehmorag : I confirmed info from the leak with the help of our community All data in there on me is 100% true in terms of payout value info This is real and will impact people for years Please don't downplay this for people that worry about it Everyone's saturation and values are different VGC / @vgc_news : UPDATE: One anonymous company source told VGC that the leaked Twitch data is legitimate, including the source code. Internally, Twitch is aware of the breach, the source said, and it's believed that the data was obtained as recently as Monday. Troy Hunt / @troyhunt : The general consensus from the masses is “it's legit”, but I'm yet to see any analysis yet. The torrent is being shared pretty extensively, it contains 278 files totalling 125GB *compressed* so it's sizeable. Here's what's inside: https://gist.github.com/... Catalin Cimpanu / @campuscodi : From the inbox: An F-Secure researcher claims password hashes are included in the Twitch leak. It's a big data dump. If anyone knows where these password hashes are located, pass me a DM. I've personally not seen them as of now. https://twitter.com/... Rachel Tobac / @racheltobac : Twitch has allegedly been hacked and leaked. Many streamers confirming personal data from the leak to be accurate. If you're a streamer and had your payout data leaked, ensure your financial services have strongest MFA available on, threat model is now sadly elevated even more. https://twitter.com/... Jason Koebler / @jason_koebler : Twitch hack/leak appears to be real, we verified by testing against our own revenue numbers https://www.vice.com/... KnowSomething / @knows0mething : Here's a more comprehensive list of leaked Twitch payouts (I will keep updating this thread as more things come out). https://twitter.com/... Catalin Cimpanu / @campuscodi : The group claimed to have leaked the data, which appears to have been extracted from a Git repository, in response to the recent “hate raids” that have been plaguing popular Twitch streamers https://twitter.com/... @mikko : Twitch (owned by Amazon) has allegedly been hacked and data leaked, including their internal red teaming tools. https://www.videogameschronicle.com/ ... Lorenzo Franceschi-Bicchierai / @lorenzofb : New: Someone just posted 135 gigabytes of internal Twitch data, including source code, internal tools, and detailed financial data of streamers. We verified the data by comparing our own internal data on Waypoint's Twitch channel to what's in the leak. https://www.vice.com/... Rami Ismail / @tha_rami : All of Twitch seems to have leaked? Like, all of it? The site, source, payout to streamers, internal references to a Steam competitor, tooling. The leaked data seems to be as recent as this week. What. https://www.videogameschronicle.com/ ... Justin Wong / @justinwong : I feel for the streamers who had their info leaked and for all the Twitch staff who are cleaning up the aftermath. It sucks big time. https://twitter.com/... AnnoyingTV / @mariohtxx : I think us streamers & supporters of your platform should be compensated for this.. perhaps subs 80% off ? 👀 https://twitter.com/... @siefe : If Mixer every wanted to make a comeback, this week is IT. 😅 https://twitter.com/... Adriana Chechik / @adrianachechik : This is a huge deal for users. I recommend changing passwords, 2fa, as well as changing any passwords connected to twitch. They stole source code but there's not much info yet. https://twitter.com/... Sinoc / @sinoc229 : Some Vapeworld assets, including some 3d emotes with specular and albedo maps I don't have whatever version of unity installed that they used, so I'm limited in what assets i can get caps of with stuff like blener and renderdoc. There's custom unity plugins in here for devs too. https://twitter.com/... Glenn Greenwald / @ggreenwald : I'm sure soft-leftists have some explanation for why it's OK that their favorite socialist stars make $200k/month from Jeff Bezos' streaming platform but it's immoral to do reporting on Substack and Rumble, but I have difficulty believing it's cogent or minimally rational. https://twitter.com/... Tim Miller / @timodc : The {insert random issue} demonstrates the hypocrisy of the MSNBC left schtick is becoming high art. Shoehorning Twitch streamers income into it is nothing short of impressive. https://twitter.com/... Chris Scullion / @scully1888 : Update: a source has confirmed to VGC that the leaked data is legit, that Twitch is aware of it and that it could have been stolen as early as Monday. https://www.videogameschronicle.com/ ... Tom Warren / @tomwarren : this Twitch leak is legit. There doesn't appear to be password / personal information in the actual leaked files, but that doesn't mean it hasn't been obtained. The leak is compressed to 125GB, but includes a huge amount of internal tools, SDKs, and code https://www.theverge.com/... @chuggaaconroy : Change your Twitch passwords, enable two-factor verification! Do it now, don't let yourself forget. https://twitter.com/... GJake / @gernaderjake : Well, number 64 here! This info being public is sorta strange, but I guess when people ask Kelsey or me “Wait, Jake makes money doing that?! ... Will he ever get a real job?” We can just share this image with a big🖕 https://twitter.com/... Rachel Tobac / @racheltobac : Intruders supposedly leaked Twitch internal red team tools & threat models — brutal. If true, this would likely include phishing lures known to be successful against Twitch employees, the hacking playbook. If you work at Twitch, be politely paranoid about messages, requests, etc. Tom Warren / @tomwarren : it looks like Twitch has been hacked in a massive breach. A 125GB file reportedly includes Twitch source code, details on creator $$$ payouts, and even a Steam competitor. Full details here: https://www.theverge.com/... https://twitter.com/... Catalin Cimpanu / @campuscodi : A former Twitch software engineer confirmed the leak's authenticity in a Signal chat earlier today; although, they were clear they had no idea how this data could have been obtained. See also Mediagazer
Context & Ripple Effects
The breach moved beyond a platform-security incident because it exposed creator payouts alongside internal code, SDKs and AWS-related services. Follow-on coverage focused on the exposure of streamers’ revenue and personal data, making creators an immediate constituency in Twitch’s response.
The incident also landed against a record of alleged security trade-offs and a 2014 attack that forced a major code rebuild. That history makes the newly exposed internal materials consequential beyond the leaked payout figures.
First-order effects
- Twitch must assess and contain the exposure of its source code, proprietary tools and internal service information while investigating whether password hashes were included, an unverified claim in the related coverage.
- Streamers face the immediate loss of privacy around earnings and personal data; the payout disclosure makes their business terms visible to audiences, peers and prospective partners.
Second-order effects
- The leaked payout records give the creator market a clearer view of Twitch’s revenue concentration: related analysis found the top 1% received more than half of 2021 payouts, while three-quarters received under $120.
- Amazon and AWS inherit operational and reputational pressure from a Twitch breach that includes internal AWS-service information, even though the reported exposure is centered on Twitch’s systems.
Third-order effects
- If repeated security failures require another broad infrastructure response, platform resilience becomes tied to whether Twitch can modernize internal systems without disrupting the creators who depend on them.
- The combination of creator-data exposure and payout transparency points toward streaming platforms treating creator privacy and security controls as part of the commercial relationship, not merely back-office risk management.
The trend: Creator platforms are becoming more accountable for securing both the technical systems and sensitive economic data that underpin their talent marketplaces.