A recent cyberattack in the cryptocurrency realm has once again sent shockwaves through the industry. The incident shed light on security vulnerabilities at Binance, a major player involved in the breach. A trader from China, known as CryptoNakamao on social platforms, fell victim to hackers who successfully siphoned off $1 million using a deceptive Google Chrome browser extension called Aggr. Originally touted as a tool to aid traders with data, the extension turned out to be a malicious instrument designed to extract user cookie information.

Cyberspace Intrigue

CryptoNakamao's suspicions were aroused when unauthorized trades appeared on his Binance account. Upon investigating Bitcoin price movements via the Binance app, he uncovered the unauthorized trading activities. Despite seeking urgent help from Binance, the hackers swiftly emptied his account before any remedial action could be taken.

The hackers sidestepped traditional security barriers such as passwords and two-factor authentication (2FA) by exploiting cookie data obtained through the Aggr extension. By infiltrating active user sessions, they orchestrated a sequence of leveraged trades aimed at manipulating the market. Their strategy involved buying highly liquid tokens and selling them in pairs with lower liquidity.

Security Scrutiny

Despite the protection supposedly offered by 2FA against direct withdrawals, the hackers executed lucrative trades through session hijacking tactics. They amassed substantial amounts of Tether (USDT) and set up limit sell orders for Bitcoin (BTC) and USD Coin (USDC) pairs. These trades led to abnormal price surges, allowing the hackers to profit from leveraged positions.

Accusations were leveled at Binance for its alleged laxity in implementing robust security measures. The affected trader criticized the platform for overlooking irregular trading patterns and failing to respond promptly to alerts. He also indicted Binance for purportedly being aware of the rogue extension and its associated risks but failing to caution users or take preemptive actions.

Heightened Displeasure

The trader expressed profound disappointment in Binance's apparent disregard for the evident threat posed by the Aggr extension. He contended that Binance's internal probe into the extension proved inadequate in safeguarding users from persistent threats. Furthermore, he rebuked the exchange for neglecting to freeze the hacker's account despite clear indications of fraudulent behavior.