No, Those Artist Channels Were Not Hacked — Here Is What Actually Happened on YouTube

“Artist YouTube channels hacked”

News spread across X, Reddit and YouTube comment sections on July 26, 2026, after unreleased and deliberately mismatched songs began appearing on the official YouTube pages of Drake, Kendrick Lamar, Playboi Carti, Kanye West and more than a dozen other acts. No account credentials appear to have been compromised. The uploads were delivered through a music distributor with weak moderation, and YouTube’s automatic artist-matching did the rest.

Key facts

• What: Unauthorized tracks, old leaks and Discord promo clips appearing on the official YouTube and YouTube Music pages of major artists
• When: July 26, 2026, continuing into July 27, 2026
• Method: Uploads delivered via the distributor OffStep under artist names identical to the real acts, credited on-page as “Provided to YouTube by OffStep”
• Artists affected: Drake, Kendrick Lamar, Playboi Carti, Kanye West, Travis Scott, Frank Ocean, Michael Jackson, Ken Carson, d4vd, Future, Juice WRLD, The Weeknd, Quadeca and several smaller acts
• Status: Developing. Neither YouTube nor OffStep had issued a public statement at the time of writing

Were the artist YouTube channels hacked?

No. There is no evidence that anyone gained access to an artist’s Google account, YouTube Studio dashboard or channel password. The tell is on the videos themselves: each carries the standard auto-generated credit line naming OffStep as the delivering distributor. That credit only appears on tracks pushed into YouTube Music through the licensed distribution pipeline — the same pipeline any independent artist uses. A hacker inside a channel would simply upload a video; they would not, and could not, manufacture a distributor credit.

The confusion is understandable, because the end result looks identical to a breach. A song shows up under the artist’s name, on the artist’s page, in the artist’s release feed. But the entry point was the distributor’s submission form, not the artist’s login.

How does a distributor loophole put songs on someone else’s channel?

YouTube automatically creates a “topic” channel for every artist whose music arrives through a distributor. Topic channels are generated by YouTube, not by the artist, and they are keyed to the artist name in the delivered metadata. As distributors including DistroKid explain in their own documentation, the artist cannot edit or delete a topic channel; it exists as YouTube Music’s reference copy of that artist’s catalogue.

Two properties of that system combine badly. First, YouTube will not maintain two topic channels under one identical artist name — a second delivery under the same name is merged into the existing one. Second, once an artist’s own channel is upgraded to an Official Artist Channel, the topic channel is folded into it. So a track submitted under the exact string “Playboi Carti” is not routed to a lookalike page. It is routed into the real one.

This is not a novel exploit. It is a known failure mode with a known name, and OffStep maintains a dedicated help-desk article titled “There are tracks in my Topic Channel and YouTube Music profile that don’t belong to me”, instructing affected artists to send in links to the offending tracks. What changed on July 26 was scale and intent: instead of one accidental metadata collision, dozens of deliberate deliveries went out at once.

Why did the uploads survive on YouTube but not on Spotify?

Almost all of the material landed on YouTube Music, with a smaller number of items reaching Apple Music. Spotify was largely untouched. The difference is moderation timing. Spotify and Apple Music apply tighter pre-release checks and act quickly on rights-holder flags against catalogue-name collisions, so a fraudulent delivery under a major-label artist name is typically rejected or pulled within minutes. YouTube’s topic-channel system is designed to ingest first and reconcile later, which leaves a window measured in hours rather than minutes.

That window is exactly what the uploaders were using. Much of the material was not rare at all — long-circulating leaks, snippets already posted years ago, and in several cases audio deliberately mismatched to the wrong artist for comic effect. Kendrick Lamar’s “Family Matters” was pushed onto his own page; Drake’s page received “Not Like Us”, the Lamar diss track aimed at him. Several uploads carried promotional pointers to a Discord server, which according to an itemised rundown by the X account Spectre gathered more than 2,000 members within hours. Attention, not archival value, was the payload.

Which artists were affected?

The list below reflects reports circulating on July 26 and 27, 2026 and has not been confirmed by the artists, their labels, YouTube or OffStep. TSNVWRLD is not linking to the uploads themselves.

What is confirmed and what is not?

The provenance point matters most. Groups running this kind of stunt routinely relabel old leaks, AI-generated audio and unrelated songs to inflate the apparent value of what they are holding. Any claim that a specific unheard record surfaced during this wave should be treated as unverified until the artist or label says otherwise.

What happens next?

Takedowns are the immediate step. Because the material entered through the licensed pipeline, removal runs through rights-holder claims and distributor action rather than a security response, which is slower than a straightforward channel recovery. Labels can also push YouTube to purge the affected topic-channel entries and re-lock the artist-name mapping.

The larger question is upstream. Any distributor that accepts a delivery under the name “Drake” without a rights check exposes the same hole, and YouTube’s name-based artist matching turns that hole into a direct line to a verified page. Whether YouTube tightens ingestion for high-profile artist names, or distributors face harder identity requirements, will determine if July 26, 2026 was a one-off or a preview. Early coverage, including a report from HipHop-N-More, framed the wave as a hacking incident — a framing the distribution credit on the videos does not support.