Binance runs monthly phishing tests on employees, warns of dismissal for repeat failures

Most companies send their employees a yearly compliance training video and call it a day. Binance sends fake phishing emails every month, and if you keep falling for them, you’re out.

The world’s largest crypto exchange has been running an internal red team operation that conducts simulated phishing attacks on its own workforce. The program has been active for more than three years, and according to Chief Security Officer Jimmy Su, it has meaningfully improved the company’s “security hygiene.” For an exchange sitting on roughly $137.7 billion in assets under management and serving 323 million registered users, that hygiene matters quite a bit.

How the program works

Binance’s red team designs scenarios that mirror real-world social engineering tactics. Think fake job recruiter messages, too-good-to-be-true conference invitations, and other lures designed to trick employees into revealing sensitive information or clicking malicious links.

Employees who take the bait don’t get a slap on the wrist and a “better luck next time.” They’re put through remedial training. Repeated failures start affecting performance ratings. And at the far end of the consequence spectrum, chronic offenders face dismissal.

Why this matters beyond Binance’s HR department

Here’s the thing: social engineering isn’t some niche attack vector. According to a report from AMLBot, roughly 65% of all crypto security incidents in 2025 were attributed to social engineering. Not zero-day exploits, not sophisticated on-chain attacks. Just people getting tricked.

The simulated attack scenarios are deliberately varied. By rotating tactics, impersonating different types of contacts, and adjusting the sophistication of the lures, the red team ensures that employees can’t just memorize one pattern and consider themselves safe.

Setting an industry benchmark

Jimmy Su’s willingness to discuss the program publicly also serves a strategic purpose. It signals to regulators and institutional partners that Binance takes operational security seriously at a granular, day-to-day level.

From an investor perspective, the implications cut in two directions. On one hand, robust internal security reduces the risk of a catastrophic breach, the kind that can wipe billions in value from exchange-held assets and crater user trust overnight. On the other hand, the fact that Binance considers this level of investment necessary tells you something about the current threat environment. If 65% of crypto security incidents stem from social engineering, the attack surface for every exchange, custodian, and protocol with human operators is enormous.

Binance’s willingness to attach real career consequences to repeated failures is the part that gives the program teeth. Training without accountability is just education. Training with the possibility of termination is behavior modification.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.