Binance Fires Staff Over Phishing Failures in Monthly Red Team Security Drills

Woofun AI reports that Binance enforces strict internal security protocols by subjecting employees to monthly simulated phishing attacks, with Chief Security Officer Jimmy Su confirming to Cointelegraph that the exchange’s red team actively tests staff to identify vulnerabilities. This aggressive stance against social engineering underscores the critical role of human-centric defense mechanisms within the world’s largest cryptocurrency exchange.

The scale of the threat is magnified by Binance’s massive footprint, which includes 323 million registered users and an estimated $137.7 billion in assets held on the platform according to DefiLlama. The prevalence of social engineering as a primary attack vector is stark; AMLBot estimated in February that 65% of crypto security incidents in 2025 were driven by such tactics. This risk materialized in April when Drift Protocol suffered a $285 million hack following a prolonged social engineering campaign, illustrating the severe financial consequences of compromised personnel.

Binance has maintained this regimen of simulated attacks for three to four years, targeting specific vectors like the "Zoom meeting attack" where malware is disguised as software updates. A notable instance occurred in September 2025 when a major Venus Protocol user lost roughly $13 million after a malicious Zoom client compromised his computer. Although Venus paused the protocol and used an emergency governance vote to recover assets, returning positions worth $11.4 million to the victim, the incident highlights the efficacy of these deceptive techniques.

Per Woofun AI, the red team employs diverse simulation scenarios beyond job recruiter impersonations, such as offering a free conference invite to attempt collecting personal information. These exercises are designed to gauge how many employees will fall for lures involving project funding or partnership proposals, thereby testing the robustness of individual security awareness against varied social engineering tactics.

Employees face tangible consequences for poor performance, as test results are directly reflected in their performance reviews. Repeated and severe failures can cause an employee’s rating to bottom out, potentially leading to them being dismissed from the organization. This policy ensures that security hygiene remains a core component of professional accountability within the firm.