A long-overlooked vulnerability led an attacker to steal nearly 18.6 million AUDIO tokens from the Web3 streaming music service.