Crypto▼ Bearish
Binance runs monthly phishing simulations to test employees
Binance tests employees with fake phishing attacks monthly, targeting social engineering risks that caused 65% of crypto losses in 2025, according to AMLBot.
Continue with
Binance runs simulated phishing attacks against its employees every month to reduce the risk of social engineering, the exchange's chief security officer said.
Jimmy Su, Binance's chief security officer, said the company's red team creates fake attacks to test whether staff recognise suspicious links and requests. Employees who fail must complete follow-up training. Repeated failures can affect performance ratings and may lead to dismissal, Su said.
The programme targets human errors that attackers use to enter crypto companies. Binance has operated the drills for three to four years, Su said. He said the company's security habits had improved during that period. Binance reports 323 million registered users, while DefiLlama tracks about $137.5 billion in assets linked to the exchange.
The red team uses methods that resemble real attacks. One test may present a fake recruiter offering a job. Another may promise free access to a conference and request personal details. The team records whether employees open the message or follow a link. Sharing information that could expose company systems is also tracked.
Su said workers who fail receive remedial training. Repeated failure "will negatively impact their rating," he said. Severe cases may push a worker's rating to the lowest level and result in dismissal. The policy gives employees a direct work-related reason to verify unexpected messages before responding.
Binance has described its red team as an internal group of ethical hackers that tests systems from an attacker's point of view. The exchange also works with external researchers through bug bounty programmes, Su said. Its security model covers technical weaknesses and employee behaviour because attackers may enter through trusted accounts or devices.
The drills come as social engineering causes a large share of reported crypto losses. AMLBot reviewed more than 2,500 investigations and found that 65% of the cases it handled in 2025 began with social engineering rather than direct software exploits. Phishing represented 18% of its cases, while device compromise accounted for 13%.