TLDR:
- Binance’s red team runs simulated phishing attacks on employees every month to test awareness.
- Scenarios include fake recruiter outreach and free conference invites to gather personal data.
- Employees who fail must complete remedial training, and repeated failures affect their ratings.
- Binance has run the phishing program for three to four years, improving staff security habits.
Binance phishing tests now run every month across the exchange’s global workforce, according to chief security officer Jimmy Su.
The internal red team designs fake attacks that mimic real threats, including recruiter outreach and free conference invitations.
Employees who fail face mandatory remedial training, while repeated serious failures can affect performance ratings. Su said the program has operated for three to four years and has improved staff security habits over time.
How Binance Phishing Tests Work
The Binance phishing tests are run by the company’s red team, an internal ethical hacking unit. Their job involves breaking into systems to find weak points before outside attackers do.
Su told Cointelegraph the tests happen monthly to track improvements in staff behavior over time. “We do phishing attacks on our own employees on a monthly basis just so we understand if our security hygiene is improving,” Su said.
Scenarios vary widely and change to match current attacker methods. One simulation has red team members pose as job recruiters reaching out to employees.
Another involves offering a free conference invitation to collect personal details from unsuspecting staff members. “It could be that we are offering some kind of free conference invite just to try to collect personal information,” Su explained.
These scenarios echo real attack methods seen across the crypto industry in recent years. A well-known example is the fake Zoom update, where hackers disguise malware as a video app patch. Many of these campaigns start with a fake job offer or a partnership proposal as bait.
Su said the program began with mixed results among employees. “In the beginning, the security hygiene left a lot to be desired,” he said. After three to four years of testing, staff habits have improved across the company, he added.
Consequences And Wider Industry Context
Employees who fail Binance phishing tests must complete remedial training sessions afterward. Su said results are tied directly to performance reviews, giving staff a reason to stay alert.
“If someone repeatedly fails the phishing-simulation attack, that will negatively impact their rating,” Su said. “That’s the incentive to be vigilant.”
Repeated, serious failures can cause a rating to drop sharply over time. Such drops could eventually lead to dismissal, according to Su. The exchange treats consistent failure as a genuine security risk rather than a minor lapse.
Binance reports 323 million registered users and holds an estimated $137.7 billion in assets, per DefiLlama data. That scale makes staff-level security failures a potential entry point for major breaches. Testing employees regularly is one way the exchange tries to close that gap.
Social engineering has become a leading cause of crypto losses industry-wide. AMLBot estimated in February that 65% of 2025 security incidents stemmed from social engineering tactics. In April, Drift Protocol lost $285 million following a long-term social engineering campaign against its systems.
A separate case saw a Venus Protocol user lose roughly $13 million in September 2025 after a fake Zoom client compromised his device, though Venus later recovered $11.4 million of the stolen funds through an emergency governance vote.