Once an attacker has the cookie needed, they use it to log into the game, and deplete the entire ROBUX bank (which can be converted to real currency), leaving the user to log in later to some ...