Binance ‘red teams’ its own staff every month to keep hackers out

Binance regularly tests its employees for security hygiene, with social engineering becoming a major source of industry breaches.

Jimmy Su, chief security officer at Binance. Source: Binance

In February, AMLBot estimated that 65% of crypto security incidents in 2025 were driven by social engineering. In April, Drift Protocol suffered a $285 million hack, which came after a long-term social engineering campaign.

Su said Binance has been running these simulated attacks for three to four years. “In the beginning, the security hygiene left a lot to be desired. But after this amount of time, the company has improved significantly.”

Simulated attack scenarios

One of the simulated attacks involves the red team posing as job recruiters, said Su.

Related: Trader loses $1M after signing phishing token approval

One of the more well-known attack methods in recent years has been the “Zoom meeting attack,” where hackers trick victims into installing malware disguised as an update to the video conferencing app. Many of these attacks start with a fake job opportunity, though some use project funding or a partnership proposal as the lure.

In September 2025, a major Venus Protocol user lost roughly $13 million after a malicious Zoom client compromised his computer, leading him to grant an attacker control over his account. Venus paused the protocol and used an emergency governance vote to recover the assets, later returning positions worth $11.4 million to the victim.

“The interview process is just one scenario. There are other ones. For example, it could be that we are offering some kind of free conference invite just to try to collect personal information and see how many of them will actually fall for it,” said Su.

Employee incentives and consequences

Su said employees are incentivized to perform well on the tests because the results are reflected in their performance reviews. “If someone repeatedly fails the phishing-simulation attack, that will negatively impact their rating. That’s the incentive to be vigilant.”

Repeated, severe failures could lead to their rating to “bottom out,” which could see them dismissed, he said.

Magazine: Fears of AI-driven DeFi hack epidemic overstated for now - but not for long