What happened
Around 25 accounts using MyAlgo, a third-party web wallet for Algorand, were drained between February 19 and 21, 2023. Reported losses were 19.5 million ALGO and 3.5 million USDC plus other assets, valued at about $9.2 million by ZachXBT and TRM Labs and about $9.6 million by CoinDesk. All victims kept mnemonic wallets inside MyAlgo. The Algorand Foundation said the Algorand protocol and SDK were not at fault, and MyAlgo told users to withdraw funds from mnemonic wallets. ChangeNOW froze about $1.5 million of related funds.
MyAlgo's investigation, published in April 2023, concluded that an attacker used a CDN API key to put a malicious proxy in front of wallet.myalgo.com. The proxy served a modified wallet app that captured users' passwords and secret phrases. MyAlgo found no vulnerability in its codebase, and it could not determine how the key was obtained.
How it happened
- The attacker obtained an API key for MyAlgo's CDN account. MyAlgo's audit logs showed no creation of such a key, and how it was obtained remains unknown.
- On January 21, 2023, the attacker used the CDN to insert malicious code between
wallet.myalgo.comand its users, targeting a specific MyAlgo release. The proxy fetched the real app and served users a modified copy. - When victims unlocked mnemonic wallets on desktop, the modified code sent their passwords and secret phrases to the attacker's server.
- MyAlgo's mid-February release stopped the injection, but the attacker already held the stolen keys.
- Between February 19 and 21, 2023, the attacker drained about 25 accounts. D13 found the thefts were ordinary single-signature transfers clustered within less than six hours, with no rekeying, logic signatures or protocol flaw involved.
Protocol details
Evidence
- report @zachxbt incident report twitter.com
- report Preliminary Advisory Report - Algorand 20-02-2023 Thefts d13.co
- analysis DeFiLlama defillama.com
- analysis Algorand Wallet MyAlgo Urges Users to Withdraw Funds After $9.2M Exploit decrypt.co
- analysis Algorand Wallet MyAlgo Advises Users to Withdraw Funds After $9.6M Exploit coindesk.com
- analysis Feb 2023 - MyAlgo Web Wallet JavaScript CDN Exploit - $9.6m (Global) quadrigainitiative.com
- analysis MyAlgo Unveils How Attackers Carried Out Recent Hack (CoinEdition via Investing.com) investing.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
