Binance Fires Staff Who Fail Monthly Phishing Tests, Security Chief Says

The most sophisticated test mimics a Zoom meeting attack. An attacker tricks someone into downloading what looks like a routine software update. It is malware. The victim installs it themselves. Binance checks whether employees pause before clicking on an unsolicited prompt, Su said.

Poor results on these tests feed directly into performance evaluations. A pattern of failures pushes an employee's rating down. A low enough rating means termination. Su said that is not a vague threat. It is policy.

The logic is not punitive. Social engineering accounted for 65% of crypto security breaches in 2025, according to AMLBot. The incidents back up the number. Drift Protocol lost $285 million through a social engineering campaign. A Venus Protocol user lost roughly $13 million after attackers compromised a Zoom client. Venus paused operations and recovered most of the assets. Most is not all, Su said.

No firewall stops a social engineering attack, he said. An employee clicks one bad link on a Tuesday afternoon, and the best technical infrastructure in the business can still get cleaned out. That is why Binance built security awareness into how people are evaluated, compensated, and retained. Employees who consistently pass are recognized. Those who fall short face real career consequences. The simulations rotate to reflect how threats evolve, so employees cannot memorize one set of warning signs and coast, Su said.

Whether other exchanges adopt similar programs is unclear. Most have not said publicly. With $137.7 billion on the line and 323 million users trusting the platform, Binance's answer to the social engineering problem is direct: make it someone's job to care, then make sure they know their job depends on it.