Binance Plays Predator vs. Payroll: Monthly Phishing Drills Can Get You Fired 🪝

Binance runs simulated phishing attacks against its own employees every month and can dismiss staff who repeatedly fail the tests, according to Binance chief security officer Jimmy Su. The exercises are carried out by Binance's internal red team, an ethical hacking unit that attempts to infiltrate company systems to surface vulnerabilities. "We do phishing attacks on our own employees on a monthly basis just so we understand if our security hygiene is improving," Su told Cointelegraph. "The ones that have failed it, we will do remediation training."

The program reflects the scale of social engineering threats now facing the crypto industry. Binance, the largest crypto exchange by user count, reports 323 million registered users, while DefiLlama estimates the exchange holds $137.7 billion in assets. In February, AMLBot estimated that 65% of crypto security incidents in 2025 were driven by social engineering. In April, Drift Protocol suffered a $285 million hack that followed a long-term social engineering campaign, and in September 2025, a major Venus Protocol user lost roughly $13 million after a malicious Zoom client compromised his computer, leading him to grant an attacker control over his account; Venus paused the protocol and used an emergency governance vote to recover the assets, later returning positions worth $11.4 million to the victim.

Su said Binance has been running these simulated attacks for three to four years. "In the beginning, the security hygiene left a lot to be desired. But after this amount of time, the company has improved significantly," he said. One recurring scenario has the red team posing as job recruiters, mirroring the "Zoom meeting attack" pattern in which hackers trick victims into installing malware disguised as a video conferencing update. "The interview process is just one scenario. There are other ones. For example, it could be that we are offering some kind of free conference invite just to try to collect personal information and see how many of them will actually fall for it," Su said.

Employee performance on the tests feeds into internal reviews, Su added. "If someone repeatedly fails the phishing-simulation attack, that will negatively impact their rating. That's the incentive to be vigilant." Repeated, severe failures could see a rating "bottom out," which could result in dismissal, he said.