A Chinese user of the popular cryptocurrency exchange Binance, Nakamao, has recently fallen victim to a sophisticated crypto theft. The hacker, operating under the radar, managed to drain Nakamao's account of a staggering $1 million worth of digital assets. The surprising aspect of this theft is that the hacker did not need Nakamao's password or two-factor authentication (2FA) to access the account.

Nakamao's account was compromised through a malicious Chrome plugin called Aggr, which he had downloaded based on recommendations from an overseas influencer. This plugin allowed the hacker to collect and exploit Nakamao's cookies, enabling them to hijack his active user session. The hacker then conducted large trades in the USDT trading pair with high liquidity and placed limit sell orders at inflated prices in pairs with scarce liquidity, profiting significantly without triggering any security alerts from Binance.

Nakamao discovered the unusual trading activity in his account on May 24, but despite immediate efforts to contact Binance customer service, the hacker continued to operate his account, ultimately withdrawing all funds safely. Nakamao expressed frustration at Binance's slow response and lack of effective risk control measures, which allowed the hacker's obvious arbitrage transactions to go unchecked.

An investigation revealed that Binance was aware of the malicious plugin and the hacker's activities weeks before Nakamao's incident, but did not take immediate action to warn users or suspend the plugin's promotion. Moreover, Binance did not implement effective risk control measures to detect and prevent the theft, noted Nakamao. The delay in contacting other platforms to freeze the hacker's funds resulted in missed opportunities to recover stolen assets, he added. Nakamao has thus demanded the need for higher security measures at the exchange to prevent such incidents in the future.