MyAlgo hack — February 2023

MyAlgo was a browser-based wallet for the Algorand network. Between 19 and 21 February 2023 funds were drained from around 25 high-value accounts. On-chain investigator ZachXBT counted roughly 19.5 million ALGO and 3.5 million USDC and valued the theft at about $9.2 million; CoinDesk reported the same token amounts as $9.6 million. Both totals rest on the same on-chain count, so the lower figure is recorded with the higher kept as the bound.

An independent advisory published on 27 February by the researcher D13 confirmed at least $7.2 million taken from 17 addresses, with a further $1.4 million suspected across four more, and found the only common threads were desktop use of MyAlgo and a recent unlocking of the wallet. Coinspect, which worked with MyAlgo, ruled out any weakness in the encryption itself and concluded the attackers had obtained users' passwords and used them to decrypt stored seeds.

MyAlgo initially said it did not know the root cause and urged all users to move assets out of any wallet that had touched the platform. The Algorand Foundation issued a formal notice on 6 March repeating that instruction and stating the Algorand protocol itself had not been compromised.

In March 2023 MyAlgo published its own findings: attackers had abused its content delivery network to inject malicious code between the wallet.myalgo.com web app and the user, collecting passwords and secret phrases and sending them to attacker-controlled servers. MyAlgo said the attackers still held the stolen keys and could still move compromised funds. The exchange ChangeNOW froze about $1.5 million. No arrests have been reported.