A Chinese trader recently lost $1 million to a sophisticated hacking scam involving a malicious Google Chrome plugin called Aggr. This plugin was designed to steal cookies from users, which hackers then used to bypass password and two-factor authentication (2FA) measures to access the trader's Binance account.

The Incident

The trader, who uses the X username CryptoNakamao, recounted the harrowing experience on the platform. On May 24, they noticed random trading activity in their Binance account when checking the Bitcoin price. By the time they sought help from Binance, the hacker had already withdrawn all their funds.

How the Hack Occurred

The hacker exploited a Chrome plugin called Aggr, which the trader installed under the impression it would provide access to prominent trader data. Instead, the plugin stole the user's web browsing data and cookies. The hackers then used these stolen cookies to hijack active user sessions without needing a password or authentication.

Using the hijacked sessions, the hacker carried out leveraged trades to manipulate the prices of low liquidity trading pairs, making a profit from the price spikes. Although the hacker could not withdraw funds directly due to 2FA, they utilized the active login sessions to execute profitable cross-trades.

The Mechanics of the Scam

1. Cookie Theft: The Aggr plugin stole cookies from the trader's browser, allowing the hacker to hijack the session.
2. Unauthorized Trades: The hacker bought tokens in the USDT trading pair with high liquidity and placed limit sell orders above the market price in BTC, USDC, and other low liquidity pairs.
3. Leveraged Positions: The hacker opened leveraged positions, buying a large amount and completing the cross-trading. This process involves offsetting buy and sell orders for the same asset without recording the trade on the exchange.

Trader's Criticism of Binance

The trader criticized Binance for its handling of the situation, alleging that the exchange did not implement necessary security measures despite the unusual trading activity. The trader also claimed that Binance failed to act even after receiving timely complaints. Furthermore, the trader found that Binance was aware of the fraudulent plugin and had been conducting an internal investigation, but did not alert users or take preventive actions.

Binance's Response

At the time of publication, Binance had not responded to Cointelegraph's request for comment regarding the incident.

Conclusion

This incident highlights the importance of stringent security measures and the potential risks associated with installing unverified plugins. It also underscores the need for exchanges to have robust monitoring and response mechanisms to protect users from sophisticated scams.