In a complex hacking incident involving a malicious Chrome plugin called Aggr, a Chinese trader suffered a significant loss of $1 million from their Binance account. The Aggr plugin is designed to extract cookies from users' browsers, which are then exploited by hackers to bypass password and two-factor authentication processes, gaining unauthorized access to the victim's cryptocurrency trading account.

The trader, identified on Binance as CryptoNakamao, discovered unusual trading activity on their account on May 24. They became aware of the suspicious activity when checking Bitcoin prices on their Binance app. Unfortunately, by the time Binance was notified, all funds had already been illicitly transferred by the hacker.

According to the affected trader, the hackers acquired their web browser's cookie data through the Aggr Chrome plugin, initially installed to access data from prominent traders. This information enabled the hackers to take control of active user sessions without needing a password or additional authentication. The hacker executed multiple leveraged trades, manipulating prices of low liquidity pairs to their benefit.

Although direct fund withdrawals were prevented by two-factor authentication, the perpetrators cleverly exploited active cookies and login sessions to conduct profitable cross-trades. They traded large volumes of tokens with high liquidity and placed sell orders above market price in trading pairs with limited liquidity.

The victim criticized Binance for allegedly failing to implement necessary security protocols in response to the unusually high trading activity. The trader also claimed that Binance, while investigating the malicious plugin, did not inform its users or take preemptive measures to mitigate further risks. Despite identifying the hacker's account and understanding the nature of the scam, the platform was accused of not promptly freezing the fraudulent funds.