Binance ‘red teams’ its own staff every month to keep hackers out

Binance regularly tests its employees for security hygiene, as social engineering is becoming a major source of industry breaches.

Cryptocurrency exchange Binance runs simulated phishing attacks against its own employees and can fire staff who repeatedly fail the tests, according to Binance chief security officer Jimmy Su.

The fake attacks are conducted by Binance’s red team, an internal ethical hacking unit whose job is to break into systems to identify vulnerabilities.

“We do phishing attacks on our own employees on a monthly basis just so we understand if our security hygiene is improving,” Su told Cointelegraph. “The ones that have failed it, we will do remediation training.” 

The measure shows the lengths crypto companies will go to prepare for social engineering attacks. Binance, the largest crypto exchange in the world, reports 323 million registered users; DefiLlama estimates the exchange holds $137.7 billion in assets.

Jimmy Su, chief security officer at Binance. Source: Binance

In February, AMLBot estimated that 65% of crypto security incidents in 2025 were driven by social engineering. In April, Drift Protocol suffered a $285 million hack, which came after a long-term social engineering campaign. 

Su said Binance has been running these simulated attacks for three to four years. 

One of the simulated attacks involves the red team posing as job recruiters, said Su. 

Related: Trader loses $1M after signing phishing token approval 

Among the more well-known attack methods used in recent years has been the “Zoom meeting attack,” where hackers trick victims into installing malware disguised as an update to the video conferencing app. Many of these attacks start with a fake job opportunity, though some use project funding or a partnership proposal as the lure. 

In September 2025, a major Venus Protocol user lost roughly $13 million after a malicious Zoom client compromised his computer, leading him to grant an attacker control over his account. Venus paused the protocol and used an emergency governance vote to recover the assets, later returning positions worth $11.4 million to the victim.