A recent hacking scam has exploited a Google Chrome plugin to steal millions from Binance accounts. The plugin, called Aggr, steals cookies from users' browsers, which hackers then use to bypass password and two-factor authentication (2FA) verification, gaining unauthorized access to victims' Binance accounts.

One such victim, a Chinese trader using the X handle CryptoNakamao, shared their experience of losing $1 million to this scam. On May 24, CryptoNakamao noticed unusual trading activity in their Binance account after checking the Bitcoin price. By the time they sought help from Binance, the hacker had already withdrawn all their funds.

The hacker's method involved stealing cookie data via the Aggr Chrome plugin. This plugin, initially installed by the trader to access prominent trading data, was actually designed to steal web browsing data and cookies. With this data, hackers hijacked active user sessions without needing passwords or 2FA, executing multiple leveraged trades to manipulate low liquidity pairs for profit.

Despite the inability to withdraw funds directly due to 2FA, the hacker used the stolen cookies and active sessions to make cross-trades. They bought several tokens in the Tether (USDT) trading pair with abundant liquidity and placed limit sell orders at inflated prices in pairs with scarce liquidity, such as Bitcoin and USD Coin (USDC). The hacker then opened leveraged positions, bought large amounts, and completed the cross-trading without recording the trades on the exchange.

The victim criticized Binance for not having adequate security measures to detect and stop the unusually high trading activity. Despite timely complaints, Binance allegedly failed to act quickly to prevent the fraudulent trades. During their investigation, the trader discovered that Binance had known about the fraudulent plugin for some time and was already conducting an internal investigation. However, Binance did not inform users or take preventive actions against the scam.

"Binance did nothing even though it knew of the theft and frequent cross-trading. Hackers manipulated accounts for over an hour, causing extremely abnormal transactions in multiple currency pairs without any risk control; Binance failed to freeze the funds of the obvious hacker’s single account in the platform on time," the trader wrote.

This incident underscores the importance of robust security measures and timely response to user reports to protect against sophisticated hacking strategies in the cryptocurrency ecosystem.