TIMELINE · DOCUMENTED EVENTS · PRIMARY SOURCES

What happened to MyAlgo Wallet?

A factual timeline. Each event below is sourced. This page exists for users who specifically want this question answered.

The brief version

The original MyAlgo Wallet, operated by Rand Labs since 2019, was a popular Algorand web wallet that experienced a JavaScript-injection exploit in February 2023, according to CoinDesk reporting. The exploit affected approximately 25 high-profile accounts and resulted in approximately $9.6 million in losses. The Algorand Foundation, ChainArgos, and others investigated; per ChainArgos analysis, the attack vector was a malicious script injected into the web wallet's runtime. Rand Labs announced the wallet's shutdown in December 2023; the service formally ended on January 30, 2024. In 2024, the brand rights were acquired by a new entity unrelated to Rand Labs, which operates the current native desktop wallet at myalgowallet.org under the same name.

The detailed timeline follows.

Timeline

MyAlgo Wallet launches

Rand Labs (the original operator) launched MyAlgo Wallet as a web wallet for the Algorand blockchain. The wallet was hosted at wallet.myalgo.com. It was the first widely-used Algorand wallet and grew to be one of the most popular options for ALGO holders during 2019-2022.

Source: Algorand Foundation announcements, AlgoExplorer historical archives.

Growth and AlgoExplorer

In addition to the wallet, Rand Labs operated AlgoExplorer (a leading Algorand block explorer with public API access). Both products served the Algorand ecosystem broadly. The wallet supported standard Algorand operations: ALGO transfers, ASA opt-in, atomic transfers, multisig, governance participation, and Ledger hardware wallet integration.

Source: Rand Labs product documentation; community archives.

Initial reports of compromised accounts

The first reports surfaced on Twitter and the Algorand subreddit: high-profile Algorand accounts were having funds drained without their owners' knowledge or consent. The accounts shared a common factor — they had used MyAlgo's web wallet at some point. Algorand Foundation investigators began coordinating with affected users and Rand Labs.

Source: Reddit thread r/AlgorandOfficial, Twitter posts from affected users (archived).

Loss confirmed at approximately $9.6M

After multiple days of investigation, the Algorand Foundation and ChainArgos (a blockchain forensics firm) confirmed approximately $9.6 million in stolen funds across approximately 25 accounts. The attack vector was identified as a JavaScript injection — malicious code that executed within the web wallet's browser context, capturing decrypted seed phrases as users signed transactions. The Algorand Foundation issued an advisory recommending all MyAlgo users with significant balances rekey to a fresh signing key on a separate wallet (Pera, Defly, or Ledger) as a precaution, regardless of whether they had detected unauthorized activity.

Sources: CoinDesk Feb 2023 reporting, Decrypt coverage, Algorand Foundation advisories, ChainArgos report.

Investigation continues; partial fund recovery

The investigation continued through 2023. ChainArgos traced funds across multiple chains. Some funds were frozen on centralized exchanges and partially returned to victims. The exact attack vector — whether a compromised dependency, a malicious script in MyAlgo's CDN chain, or a phishing campaign at scale — was the subject of multiple reports with overlapping but distinct conclusions. Rand Labs published partial post-mortems but did not commit to a full public technical disclosure.

Sources: ChainArgos analysis, follow-up CoinDesk and Decrypt reporting.

MyAlgo shutdown announced

Rand Labs announced that the MyAlgo Wallet service would be discontinued. Users were given approximately seven weeks to migrate funds to other wallets. The announcement specifically recommended Pera and Defly as migration destinations, alongside Ledger hardware integration.

Sources: Rand Labs announcement, Decrypt coverage, Reddit threads.

Original web wallet service ends

The web wallet at wallet.myalgo.com formally ended service on January 30, 2024. Users with funds remaining at that point retained access via their seed phrase to import into other wallets, but the MyAlgo web interface was no longer operational. The MyAlgo brand and domain rights were subsequently transferred to a new entity unrelated to Rand Labs through documented legal counsel and IP review.

Source: Rand Labs final announcement; subsequent IP-transfer documentation.

Current operation — independent of Rand Labs

The current MyAlgo Wallet is a native desktop application for Windows, macOS, and Linux. The application ships from myalgowallet.org with verified checksums, and is operated by an entity unrelated to the original Rand Labs team. The architecture is intentionally different from the original web wallet — keys are generated and stored locally, no browser session is involved. The MyAlgo brand and trademark rights were transferred to the current operator in 2024 through documented legal counsel and IP review; there is no continuity of code, infrastructure, or personnel with Rand Labs.

The current state is documented at /security. The migration path for users with old accounts is at /migrate-from-myalgo.

What this means for affected users

If you held funds in the original MyAlgo Wallet between 2019 and January 2024, the practical guidance is at the migration guide.

  • Your funds remain on the Algorand blockchain unless they were stolen during the 2023 incident. The wallet shutdown does not affect on-chain assets.
  • If your seed phrase was stored on the original web wallet at any point, follow the rekey path rather than direct seed import to a new wallet.
  • The Algorand Foundation, MyAlgo Wallet (current), and other Algorand wallet operators do not perform recovery on your behalf — only your seed phrase grants control.
  • Anyone offering "MyAlgo recovery" services in exchange for payment or your seed phrase is not affiliated with anyone legitimate.

What this does not mean

This page documents events. It does not:

  • Argue that the original incident was the fault of any specific party
  • Re-litigate the technical details of the attack vector
  • Make claims about Rand Labs' subsequent operations or current entities
  • Imply that affected users will receive compensation from any party

For users wanting deeper technical coverage of the original incident, the ChainArgos report and CoinDesk's February 28, 2023 article are the most-cited primary sources.

Frequently asked questions

Did people lose all their funds in the MyAlgo hack?

Approximately 25 high-profile accounts were drained for approximately $9.6 million total. The MyAlgo wallet had thousands of users; most accounts were not affected. ChainArgos traced funds and some were partially recovered through exchange freezes, but full recovery did not occur for most affected users.

Who runs MyAlgo Wallet now?

The current MyAlgo Wallet at myalgowallet.org is operated by an entity unrelated to Rand Labs. The brand was acquired through a documented rights transfer in 2024. The current operation is a native desktop application — distinct architecture from the original web wallet. The about page covers entity information.

Is the Algorand Foundation involved with MyAlgo?

No. The Algorand Foundation is an independent entity supporting the broader Algorand ecosystem. They are not affiliated with the original Rand Labs operation, with the MyAlgo brand acquisition, or with the current MyAlgo Wallet. The Algorand Foundation's role in the 2023 incident was advisory — coordinating user response and recommending mitigation paths.

What happened to AlgoExplorer?

AlgoExplorer was a separate Rand Labs product. Its free API tier was discontinued in June 2023. Most active Algorand users now use Pera Explorer or allo.info as primary block explorers.

Current MyAlgo state.

The current MyAlgo desktop wallet is documented at /security (architecture) and /about (entity information). The migration guide at /migrate-from-myalgo covers practical steps for users with old accounts.

Download MyAlgo