A cyberattack occurs within the network of the world’s largest crypto exchange every month. However, the perpetrators are not external hacker groups, but the company’s own internal security team. Binance runs a dedicated program targeting its employees with simulated social engineering tactics (phishing) to monitor their progress in digital security discipline.
Binance Chief Security Officer Jimmy Su revealed this practice in an interview. The company operates an internal red team that acts as an ethical hacking unit to uncover system vulnerabilities from within. Having run for 3-4 years, this operation carries significant responsibility, given that Binance now hosts 323 million registered users and manages $137.7 billion in assets, according to DefiLlama estimates.
Fake Scenarios Leading to Termination
In carrying out its operations, Binance’s red team employs various methods. Routinely tested scenarios include posing as recruiters offering job opportunities or sending free conference invitations to lure victims into handing over personal information. Employees who fall for these simulated traps are required to undergo remedial training.
For staff who ignore warnings, the consequences are severe. Jimmy Su emphasized that repeated and severe failures in these simulation tests will drive performance evaluation ratings down to the bottom (bottom out). At that stage, employees can be terminated. This policy ensures every staff member remains vigilant, as test results directly affect performance reviews that determine their compensation.
Humans as the Sweetest Vulnerability
Binance’s strict stance stems from industry breach patterns increasingly targeting individuals. In February 2026, AMLBot estimated that 65% of crypto security incidents throughout 2025 were driven by social engineering tactics. Malicious actors now prefer manipulating network administrators rather than breaching layers of code protection.
The consequences are costly. Drift Protocol lost $285 million in funds in April 2026 following a prolonged social engineering campaign. Another equally popular attack tactic is the “Zoom meeting attack,” where hackers trick victims into installing fake video call updates bundled with malware. This type of trap claimed a victim from Venus Protocol in September 2025, who lost around $13 million in assets after a malicious Zoom client was installed on their computer.
When hundreds of millions of dollars can vanish through a single phishing link, firewalls are meaningless without the vigilance of the users behind them. These monthly tests from internal peers are set to remain a mandatory routine to prevent system access keys from falling into the wrong hands.
Reported by Cointelegraph.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
