{"investigation":{"slug":"myalgo","entity_name":"MyAlgo","trust_score":12,"severity_base":null,"score_modifier":0,"confidence":0.88,"status":"published","content_type":"investigation","summary":"MyAlgo was a non-custodial web browser wallet for the Algorand blockchain, developed by Rand Labs. Between January and March 2023, a supply-chain attack via a compromised CDN (content delivery network) resulted in the theft of approximately $9.6 million in ALGO and USDC across at least five distinct attack waves. The wallet was officially shut down on January 30, 2024, following the incident and subsequent user attrition.","sections":[{"content":"MyAlgo was a non-custodial, browser-based wallet for the Algorand blockchain, developed and maintained by Rand Labs Inc. It allowed users to store ALGO and Algorand Standard Assets (ASAs), participate in Algorand governance, and sign transactions without browser extensions or plugins via MyAlgo Connect, an SDK for decentralized applications. The wallet stored encrypted private keys locally in the browser, making it a popular entry point for the Algorand ecosystem. At peak activity, it was one of the primary wallets used by Algorand community members and protocol developers.","heading":"Overview","sources":[{"url":"https://crypto-economy.com/rand-labs-releases-the-new-version-of-my-algo-algorand-wallet/","name":"Rand Labs Releases the New Version of My Algo Algorand Wallet","type":"news_article","credibility":2},{"url":"https://developer.algorand.org/articles/introducing-myalgo-connect/","name":"Introducing MyAlgo Connect for DApp Developers - Algorand Developer Portal","type":"official","credibility":1},{"url":"https://info.algorand.foundation/developer-stories/randlabs","name":"Algorand Developer Stories: Rand Labs","type":"official","credibility":1}],"severity":"low"},{"content":"On January 21, 2023, a malicious worker was uploaded to the content delivery network (CDN) serving the MyAlgo web application. This actor injected malicious JavaScript code that established a man-in-the-middle proxy between the legitimate wallet interface and users visiting wallet.myalgo.com. The modified code silently exfiltrated unencrypted private keys and user passwords at the moment of wallet unlock. Users with mnemonic (seed-phrase) wallets whose keys were stored in the browser were exclusively affected; hardware wallet users were not impacted. A new version of MyAlgo was released in mid-February 2023, halting the injection, but stolen credentials had already been harvested. Security firm Coinspect, which voluntarily collaborated with Rand Labs on the post-incident investigation, confirmed that the attack vector was password and seed acquisition — not a flaw in the wallet's own encryption implementation. The method by which attackers obtained the CDN API key to upload the malicious worker was not publicly determined.","heading":"CDN Supply-Chain Attack and Private Key Exfiltration","sources":[{"url":"https://quadrigainitiative.com/casestudy/myalgowebwalletjavascriptcdnexploit.php","name":"Feb 2023 - MyAlgo Web Wallet JavaScript CDN Exploit ($9.6M) - Quadriga Initiative","type":"research","credibility":2},{"url":"https://coinspect.medium.com/addressing-rumors-and-recommendations-following-the-myalgo-wallet-hack-77b249a80d18","name":"Addressing Rumors and Recommendations Following the MyAlgo Wallet Hack - Coinspect Security","type":"research","credibility":2},{"url":"https://www.investing.com/news/cryptocurrency-news/myalgo-unveils-how-attackers-carried-out-recent-hack-3035319","name":"MyAlgo Unveils How Attackers Carried Out Recent Hack - CoinEdition via Investing.com","type":"news_article","credibility":2},{"url":"https://d13.co/algorand-20-02-2023-thefts-preliminary-advisory-report/","name":"Preliminary Advisory Report - Algorand 20-02-2023 Thefts - D13.co","type":"research","credibility":2}],"severity":"critical"},{"content":"The attack unfolded in at least five distinct waves between February 19 and March 31, 2023. The total loss has been reported at approximately $9.2 million to $9.6 million, comprising roughly 19.5 million ALGO tokens and 3.5 million USDC. Blockchain investigator ZachXBT was among the first to quantify and publicly report the stolen amounts, citing data from on-chain analytics firm TRM Labs. The Algorand Foundation's CTO John Woods stated that approximately 25 wallets were directly affected. Centralized exchange ChangeNOW froze approximately $1.5 million of the stolen funds when the attacker attempted to launder assets through the platform. Instant exchange SimpleSwap also intercepted and returned a portion of stolen funds. Related incidents in the same period included an alleged infiltration of an Algodex company wallet (loss under $55,000) and a $65,000 theft from Lofty.ai, both on the Algorand network, though a direct causal link to the MyAlgo attack was not confirmed.","heading":"Financial Losses and Affected Accounts","sources":[{"url":"https://www.coindesk.com/business/2023/02/28/algorand-wallet-myalgo-struck-by-96m-exploit","name":"Algorand Wallet MyAlgo Advises Users to Withdraw Funds After $9.6M Exploit - CoinDesk","type":"news_article","credibility":1},{"url":"https://cointelegraph.com/news/myalgo-users-urged-to-withdraw-as-cause-of-9-2m-hack-remains-unknown","name":"MyAlgo users urged to withdraw, as cause of $9.2M hack remains unknown - CoinTelegraph","type":"news_article","credibility":1},{"url":"https://simpleswap.io/blog/simpleswap-returns-funds-stolen-in-the-myalgo-hack","name":"SimpleSwap Returns Funds Stolen In The MyAlgo Hack","type":"official","credibility":2},{"url":"https://cointelegraph.com/news/algodex-reveals-wallet-infiltrated-by-malicious-actor-as-myalgo-renews-warning-withdraw-now","name":"Algodex reveals wallet infiltrated by malicious actor as MyAlgo renews warning - CoinTelegraph","type":"news_article","credibility":1},{"url":"https://d13.co/myalgo-hack-fifth-wave-addresses-data/","name":"MyAlgo hack: Fifth Wave - Addresses & Data - D13.co","type":"on_chain","credibility":2}],"severity":"critical"},{"content":"The Algorand Foundation was publicly criticized for its slow response. ZachXBT openly condemned the Foundation on social media, stating: 'How about you clowns actually acknowledge the ongoing attack stealing millions from community members and assist them.' The Foundation did not publicly acknowledge the incident until March 6, 2023, approximately two weeks after the first theft wave. Foundation CTO John Woods subsequently confirmed that the exploit was 'not the result of an underlying issue with the Algorand protocol or SDK.' MyAlgo itself issued warnings on February 27, 2023, strongly advising all users to withdraw funds from mnemonic wallets and to 'rekey' accounts — a native Algorand feature that replaces the private spending key while preserving the public wallet address. The Algorand developer collective D13.co published an independent preliminary advisory report and documented all five attack waves with on-chain address data.","heading":"Algorand Foundation and Developer Response","sources":[{"url":"https://cryptoslate.com/algorand-blasted-over-inaction-on-ongoing-wallet-drain-hack/","name":"Algorand blasted over inaction on ongoing wallet drain hack - CryptoSlate","type":"news_article","credibility":2},{"url":"https://www.blockhead.co/2023/03/09/a-truly-difficult-time-algorand-releases-hack-statement/","name":"A Truly Difficult Time: Algorand Foundation Releases Hack Statement - Blockhead","type":"news_article","credibility":2},{"url":"https://insidebitcoins.com/news/algorand-facing-criticism-for-ignoring-the-week-old-myalgo-wallet-hack","name":"Algorand facing criticism for ignoring the week-old MyAlgo wallet hack - Inside Bitcoins","type":"news_article","credibility":2},{"url":"https://decrypt.co/122360/algorand-wallet-myalgo-urgest-users-withdraw-funds-9-2m-exploit","name":"Algorand Wallet MyAlgo Urges Users to Withdraw Funds After $9.2M Exploit - Decrypt","type":"news_article","credibility":2}],"severity":"high"},{"content":"Coinspect Security conducted a voluntary post-incident analysis in collaboration with Rand Labs. The investigation explicitly ruled out: software bugs in MyAlgo's own codebase, vulnerabilities in software dependencies, browser-based exploits (including autofill abuse), user negligence, phishing of affected individuals, encryption algorithm weaknesses, brute-force password attacks, and malware. The confirmed finding was that attackers obtained user passwords and used them to decrypt locally stored seeds — consistent with the CDN injection timeline established elsewhere. The D13.co report corroborated that all compromised transactions were signed with valid keys, indicating full private key exposure rather than partial compromise. The precise mechanism by which attackers gained write access to the CDN to upload the malicious worker was not publicly disclosed. No attacker was publicly identified or arrested as of available reporting.","heading":"Investigation Findings and Unresolved Questions","sources":[{"url":"https://coinspect.medium.com/addressing-rumors-and-recommendations-following-the-myalgo-wallet-hack-77b249a80d18","name":"Addressing Rumors and Recommendations Following the MyAlgo Wallet Hack - Coinspect Security","type":"research","credibility":2},{"url":"https://d13.co/algorand-20-02-2023-thefts-preliminary-advisory-report/","name":"Preliminary Advisory Report - Algorand 20-02-2023 Thefts - D13.co","type":"research","credibility":2},{"url":"https://www.investing.com/news/cryptocurrency-news/myalgo-to-unveil-preliminary-findings-regarding-the-9m-hack-3033979","name":"MyAlgo to Unveil Preliminary Findings Regarding the $9M Hack - CoinEdition via Investing.com","type":"news_article","credibility":2}],"severity":"high"},{"content":"Following the security incident and a subsequent decline in user activity, Rand Labs announced the sunsetting of the MyAlgo platform. As of January 30, 2024, the MyAlgo wallet was officially decommissioned and ceased to be accessible for transaction signing or asset management. Users were advised to migrate seed phrases to alternative wallets prior to shutdown. The wallet.myalgo.com domain now redirects to a shutdown notice page. No successor product was launched by Rand Labs to replace MyAlgo's functionality for end users.","heading":"Shutdown and Current Status","sources":[{"url":"https://web3.bitget.com/crypto-news/myalgo-wallet-history-security-and-alternatives","name":"MyAlgo Wallet: Security Breach and 2024 Sunset Guide - Bitget Wallet","type":"news_article","credibility":2},{"url":"https://wallet.myalgo.com/shut-down","name":"Algorand Wallet Shutdown Page","type":"official","credibility":1}],"severity":"medium"}],"timeline":[{"date":"2021-02-16","event":"Rand Labs releases updated MyAlgo wallet with multisig support, establishing it as a primary Algorand wallet.","source":"GlobeNewswire","source_url":"https://www.globenewswire.com/news-release/2021/02/16/2176498/0/en/My-Algo-releases-new-Algorand-Wallet-with-Multisig-Support.html"},{"date":"2023-01-21","event":"Malicious JavaScript worker uploaded to the CDN serving wallet.myalgo.com, beginning silent private key exfiltration from users who unlocked their wallets.","source":"Quadriga Initiative case study","source_url":"https://quadrigainitiative.com/casestudy/myalgowebwalletjavascriptcdnexploit.php"},{"date":"2023-02-19","event":"First wave of active thefts begins; attackers use harvested credentials to drain approximately $7.2 million confirmed across 17 addresses.","source":"D13.co preliminary advisory report","source_url":"https://d13.co/algorand-20-02-2023-thefts-preliminary-advisory-report/"},{"date":"2023-02-21","event":"First theft wave concludes. Total losses in this wave estimated at $9.2-9.6 million including 19.5M ALGO and 3.5M USDC. ZachXBT publicly quantifies stolen amounts.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2023/02/28/algorand-wallet-myalgo-struck-by-96m-exploit"},{"date":"2023-02-27","event":"MyAlgo issues public warning advising all mnemonic wallet users to immediately withdraw funds. New wallet version released, ending the CDN injection.","source":"Decrypt","source_url":"https://decrypt.co/122360/algorand-wallet-myalgo-urgest-users-withdraw-funds-9-2m-exploit"},{"date":"2023-02-28","event":"CoinDesk publishes initial reporting. ChangeNOW freezes approximately $1.5 million in stolen funds transiting through its platform.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2023/02/28/algorand-wallet-myalgo-struck-by-96m-exploit"},{"date":"2023-03-05","event":"Second wave of thefts begins, targeting additional compromised credentials.","source":"D13.co fifth wave data","source_url":"https://d13.co/myalgo-hack-fifth-wave-addresses-data/"},{"date":"2023-03-06","event":"Algorand Foundation publicly acknowledges the exploit after approximately two weeks of silence. Algodex also reports its company wallet was infiltrated by a malicious actor (loss under $55,000). Lofty.ai reports $65,000 theft on Algorand.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/algodex-reveals-wallet-infiltrated-by-malicious-actor-as-myalgo-renews-warning-withdraw-now"},{"date":"2023-03-09","event":"Algorand Foundation CTO John Woods releases statement confirming the exploit is not caused by an underlying issue with the Algorand protocol or SDK.","source":"Blockhead","source_url":"https://www.blockhead.co/2023/03/09/a-truly-difficult-time-algorand-releases-hack-statement/"},{"date":"2023-03-17","event":"Fourth wave of thefts occurs.","source":"D13.co fifth wave data","source_url":"https://d13.co/myalgo-hack-fifth-wave-addresses-data/"},{"date":"2023-03-31","event":"Fifth and final documented wave of thefts occurs.","source":"D13.co fifth wave data","source_url":"https://d13.co/myalgo-hack-fifth-wave-addresses-data/"},{"date":"2023-04","event":"Exploit details — including the CDN injection date of January 21 — are publicly revealed. MyAlgo discloses preliminary findings identifying CDN MITM as the attack vector.","source":"Quadriga Initiative case study","source_url":"https://quadrigainitiative.com/casestudy/myalgowebwalletjavascriptcdnexploit.php","date_original":"2023-04-01"},{"date":"2024-01-30","event":"MyAlgo wallet officially shut down and decommissioned. Platform no longer accessible for transaction signing.","source":"Bitget Wallet guide","source_url":"https://web3.bitget.com/crypto-news/myalgo-wallet-history-security-and-alternatives"}],"sources_used":[{"url":"https://crypto-economy.com/rand-labs-releases-the-new-version-of-my-algo-algorand-wallet/","name":"Rand Labs Releases the New Version of My Algo Algorand Wallet","type":"news_article","archive_url":"https://web.archive.org/web/20260830041328/https://crypto-economy.com/rand-labs-releases-the-new-version-of-my-algo-algorand-wallet/","credibility":2,"archive_timestamp":"2026-08-30T04:13:28+00:00"},{"url":"https://developer.algorand.org/articles/introducing-myalgo-connect/","name":"Introducing MyAlgo Connect for DApp Developers - Algorand Developer Portal","type":"official","archive_url":null,"credibility":1,"archive_timestamp":null},{"url":"https://info.algorand.foundation/developer-stories/randlabs","name":"Algorand Developer Stories: Rand Labs","type":"official","archive_url":null,"credibility":1,"archive_timestamp":null},{"url":"https://quadrigainitiative.com/casestudy/myalgowebwalletjavascriptcdnexploit.php","name":"Feb 2023 - MyAlgo Web Wallet JavaScript CDN Exploit ($9.6M) - Quadriga Initiative","type":"research","archive_url":"http://web.archive.org/web/20260519161332/https://quadrigainitiative.com/casestudy/myalgowebwalletjavascriptcdnexploit.php","credibility":2,"archive_timestamp":"2026-05-19T16:13:32+00:00"},{"url":"https://coinspect.medium.com/addressing-rumors-and-recommendations-following-the-myalgo-wallet-hack-77b249a80d18","name":"Addressing Rumors and Recommendations Following the MyAlgo Wallet Hack - Coinspect Security","type":"research","archive_url":"http://web.archive.org/web/20251113142042/https://coinspect.medium.com/addressing-rumors-and-recommendations-following-the-myalgo-wallet-hack-77b249a80d18","credibility":2,"archive_timestamp":"2025-11-13T14:20:42+00:00"},{"url":"https://www.investing.com/news/cryptocurrency-news/myalgo-unveils-how-attackers-carried-out-recent-hack-3035319","name":"MyAlgo Unveils How Attackers Carried Out Recent Hack - CoinEdition via Investing.com","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://d13.co/algorand-20-02-2023-thefts-preliminary-advisory-report/","name":"Preliminary Advisory Report - Algorand 20-02-2023 Thefts - D13.co","type":"research","archive_url":"http://web.archive.org/web/20260416173348/https://d13.co/algorand-20-02-2023-thefts-preliminary-advisory-report/","credibility":2,"archive_timestamp":"2026-04-16T17:33:48+00:00"},{"url":"https://www.coindesk.com/business/2023/02/28/algorand-wallet-myalgo-struck-by-96m-exploit","name":"Algorand Wallet MyAlgo Advises Users to Withdraw Funds After $9.6M Exploit - CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260725053816/https://www.coindesk.com/business/2023/02/28/algorand-wallet-myalgo-struck-by-96m-exploit","credibility":1,"archive_timestamp":"2026-07-25T05:38:16+00:00"},{"url":"https://cointelegraph.com/news/myalgo-users-urged-to-withdraw-as-cause-of-9-2m-hack-remains-unknown","name":"MyAlgo users urged to withdraw, as cause of $9.2M hack remains unknown - CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20251127072417/https://cointelegraph.com/news/myalgo-users-urged-to-withdraw-as-cause-of-9-2m-hack-remains-unknown","credibility":1,"archive_timestamp":"2025-11-27T07:24:17+00:00"},{"url":"https://simpleswap.io/blog/simpleswap-returns-funds-stolen-in-the-myalgo-hack","name":"SimpleSwap Returns Funds Stolen In The MyAlgo Hack","type":"official","archive_url":"http://web.archive.org/web/20260511150440/https://simpleswap.io/blog/simpleswap-returns-funds-stolen-in-the-myalgo-hack","credibility":2,"archive_timestamp":"2026-05-11T15:04:40+00:00"},{"url":"https://cointelegraph.com/news/algodex-reveals-wallet-infiltrated-by-malicious-actor-as-myalgo-renews-warning-withdraw-now","name":"Algodex reveals wallet infiltrated by malicious actor as MyAlgo renews warning - CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20260305173930/https://cointelegraph.com/news/algodex-reveals-wallet-infiltrated-by-malicious-actor-as-myalgo-renews-warning-withdraw-now","credibility":1,"archive_timestamp":"2026-03-05T17:39:30+00:00"},{"url":"https://d13.co/myalgo-hack-fifth-wave-addresses-data/","name":"MyAlgo hack: Fifth Wave - Addresses & Data - D13.co","type":"on_chain","archive_url":"http://web.archive.org/web/20260608145258/https://d13.co/myalgo-hack-fifth-wave-addresses-data/","credibility":2,"archive_timestamp":"2026-06-08T14:52:58+00:00"},{"url":"https://cryptoslate.com/algorand-blasted-over-inaction-on-ongoing-wallet-drain-hack/","name":"Algorand blasted over inaction on ongoing wallet drain hack - CryptoSlate","type":"news_article","archive_url":"https://web.archive.org/web/20260830042228/https://cryptoslate.com/algorand-blasted-over-inaction-on-ongoing-wallet-drain-hack/","credibility":2,"archive_timestamp":"2026-08-30T04:22:28+00:00"},{"url":"https://www.blockhead.co/2023/03/09/a-truly-difficult-time-algorand-releases-hack-statement/","name":"A Truly Difficult Time: Algorand Foundation Releases Hack Statement - Blockhead","type":"news_article","archive_url":"http://web.archive.org/web/20260520012452/https://www.blockhead.co/2023/03/09/a-truly-difficult-time-algorand-releases-hack-statement/","credibility":2,"archive_timestamp":"2026-05-20T01:24:52+00:00"},{"url":"https://insidebitcoins.com/news/algorand-facing-criticism-for-ignoring-the-week-old-myalgo-wallet-hack","name":"Algorand facing criticism for ignoring the week-old MyAlgo wallet hack - Inside Bitcoins","type":"news_article","archive_url":"http://web.archive.org/web/20250914053713/https://insidebitcoins.com/news/algorand-facing-criticism-for-ignoring-the-week-old-myalgo-wallet-hack","credibility":2,"archive_timestamp":"2025-09-14T05:37:13+00:00"},{"url":"https://decrypt.co/122360/algorand-wallet-myalgo-urgest-users-withdraw-funds-9-2m-exploit","name":"Algorand Wallet MyAlgo Urges Users to Withdraw Funds After $9.2M Exploit - Decrypt","type":"news_article","archive_url":"http://web.archive.org/web/20260416050237/https://decrypt.co/122360/algorand-wallet-myalgo-urgest-users-withdraw-funds-9-2m-exploit","credibility":2,"archive_timestamp":"2026-04-16T05:02:37+00:00"},{"url":"https://www.investing.com/news/cryptocurrency-news/myalgo-to-unveil-preliminary-findings-regarding-the-9m-hack-3033979","name":"MyAlgo to Unveil Preliminary Findings Regarding the $9M Hack - CoinEdition via Investing.com","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://web3.bitget.com/crypto-news/myalgo-wallet-history-security-and-alternatives","name":"MyAlgo Wallet: Security Breach and 2024 Sunset Guide - Bitget Wallet","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://wallet.myalgo.com/shut-down","name":"Algorand Wallet Shutdown Page","type":"official","archive_url":null,"credibility":1,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:43.997128+00:00","updated_at":"2026-08-30T05:14:11.737995+00:00"}}