Binance ‘red teams’ its own staff every month to keep hackers outBinance regularly tests its employees for security hygiene, with social engineering becoming a major source of industry breaches.

Cryptocurrency exchange Binance regularly conducts internal simulated phishing attacks on its employees as part of a proactive security measure to enhance the company’s defenses against social engineering. These tests are performed monthly by Binance’s internal “red team,” an ethical hacking unit tasked with identifying system vulnerabilities. Employees who fail these phishing simulations receive remediation training, and repeated failures negatively affect their performance reviews, potentially leading to dismissal. This rigorous approach reflects Binance’s commitment to improving security hygiene over the past three to four years, a period during which significant progress has been reported.

Binance is the world’s largest crypto exchange, with 323 million registered users and approximately $137.7 billion in assets under custody, according to DefiLlama. The rationale for such intensive internal security measures is highlighted by trends in the crypto industry, where social engineering attacks are a major factor in breaches. For instance, in 2025, 65% of crypto security incidents were attributed to social engineering, according to AMLBot estimates. A notable recent example involved the Drift Protocol losing $285 million after a social engineering campaign, emphasizing the threat’s severity.

The red team’s simulated phishing scenarios include diverse tactics, such as impersonating job recruiters, offering free conference invitations, or presenting fake partnership proposals to collect sensitive information. One widely known attack vector involves “Zoom meeting attacks” where victims are tricked into installing malware disguised as legitimate updates. A major incident in September 2025 involved a Venus Protocol user losing about $13 million after falling victim to such a malicious Zoom client, though emergency governance actions allowed recovery of a significant portion of assets.

Binance chief security officer Jimmy Su emphasized that the internal phishing exercises are designed not only to identify vulnerabilities but also to instill vigilance in staff, linking test outcomes to performance incentives. This approach illustrates the broader industry recognition that employee awareness is crucial in preventing costly security breaches that often start with seemingly innocuous social engineering tactics.