Binance runs monthly phishing simulations. Fail too many, and you’re out.
The world’s largest crypto exchange has quietly built one of the more aggressive internal security programs in the industry, using fake attacks to test whether its own staff can spot a scam before a real hacker does. Employees who don’t pass face remediation training. Repeat failures hit their performance reviews. And in the worst cases, it can cost them their jobs. Jimmy Su, Binance’s chief security officer, laid out how the program works — and why the stakes are that high.
Three to Four Years of Red Team Drills
Su said the red team has been running these exercises for three to four years. Not a pilot program. Not an experiment. A consistent, years-long effort to harden the human layer of Binance’s security stack — which, given that the exchange holds an estimated $137.7 billion in assets and serves 323 million registered users, is probably the most exposed layer of all.
The simulations are built to mirror real attacks. Not generic “click this suspicious link” tests, but actual social engineering playbooks pulled from current threat intelligence. One tactic the red team uses: impersonating job recruiters. Attackers in the wild do the same thing — they reach out to employees at target companies with fake offers, build rapport, then push malware or credential-harvesting links. Binance’s red team runs the same play, watching to see who bites.
Another scenario involves fake conference invitations. Employees get invited to a fictitious event, and the test measures whether they hand over personal information to claim their spot. It’s a pretty basic lure, but it works — which is exactly why it keeps showing up in real-world attacks.
Then there’s the Zoom meeting attack. Su called it one of the more sophisticated methods in circulation right now. The setup: an attacker tricks someone into downloading what looks like a routine Zoom update. It’s malware. The victim installs it themselves, thinking they’re just keeping their software current. Binance’s red team simulates this too, testing whether employees pause before clicking “install” on an unsolicited prompt.
Failure Has Real Consequences
Su was direct about what happens when someone doesn’t perform. Poor results in the phishing simulations feed directly into performance evaluations. A pattern of failures can push an employee’s rating down. And a low enough rating can mean termination. That’s not a vague threat — it’s policy.
The logic isn’t punitive for its own sake. It’s that social engineering has become the dominant attack vector across the crypto industry. Per AMLBot, social engineering accounted for 65% of crypto security breaches in 2025. That number is hard to ignore when you’re running an exchange at Binance’s scale.
The incidents back it up. Drift Protocol got hit for $285 million through a social engineering campaign. A Venus Protocol user lost roughly $13 million after attackers compromised a Zoom client — Venus paused operations and recovered most of the assets, but “most” isn’t all. These aren’t edge cases anymore. They’re basically the standard threat model.
And the thing about social engineering is that no firewall stops it. You can have the best technical infrastructure in the business and still get cleaned out because one employee clicked a bad link on a Tuesday afternoon. That’s why Binance is betting that the right response is cultural — make security awareness part of how people are evaluated, compensated, and retained.
Security Awareness as a Job Requirement
Su’s framing is pretty clear: passing these tests isn’t optional, and it’s not separate from an employee’s core responsibilities. It’s baked into how Binance measures performance. Employees who excel are recognized for it. Those who consistently fall short face real career consequences.
The red team’s job is to stay ahead of whatever attackers are actually doing — not last year’s playbook, but current tactics. Fake recruiters, fake conferences, fake software updates. The simulations rotate to reflect how threats evolve, which means employees can’t just memorize one set of warning signs and coast.
Whether other exchanges adopt anything close to this kind of program is unclear. Most haven’t said publicly. But with $137.7 billion on the line and 323 million users trusting the platform with their funds, Binance’s answer to the social engineering problem is apparently: make it someone’s job to care, then make sure they know their job depends on it.
Su said repeated failures can result in a downward adjustment in employee ratings — potentially leading to termination.
Frequently Asked Questions
What phishing tactics does Binance’s red team simulate?
Binance’s red team impersonates job recruiters, sends fake conference invitations, and simulates Zoom meeting attacks where malware is disguised as a software update.
What happens to Binance employees who fail phishing tests repeatedly?
Per Jimmy Su, repeated failures lead to a downward adjustment in performance ratings, which can ultimately result in termination.
