Binance has been running monthly simulated phishing attacks against its own employees as part of an internal security program led by its “Red Team,” according to a report cited by WuBlockchain. Binance Chief Security Officer Jimmy Su confirmed that the program has been in place for three to four years and is intended to make security awareness part of the company’s internal culture. In cybersecurity, red teams are typically tasked with probing an organization’s defenses from an attacker’s perspective, including by testing how people, processes and systems respond under pressure.

The simulations test whether employees will click malicious links, disclose credentials or provide personal information under false pretenses. Scenarios have included fake recruitment approaches, fraudulent conference invitations and other attempts to collect sensitive data. Employees who fail the tests are required to complete remedial training. Repeated serious failures can affect performance reviews and may lead to termination.

The program reflects Binance’s view that human error can pose security risks comparable to technical vulnerabilities. For a large cryptocurrency exchange that holds substantial customer assets, a compromised internal account could potentially expose wallet infrastructure, trading systems or customer data. Phishing controls therefore sit alongside technical safeguards such as access management, account monitoring and incident response procedures, rather than replacing them.

Phishing Tests as Internal Security Controls

Social engineering remains a common method used in cryptocurrency-related breaches. SIM swaps, spear-phishing campaigns and credential-harvesting attacks can bypass technical controls by persuading employees or users to provide access directly. Binance’s monthly drills are designed to test employee decision-making under realistic conditions and identify staff members who may require further training.

The approach also comes as regulatory scrutiny of the cryptocurrency industry continues to increase. In the United States, a legislative dispute over a major crypto bill was reported to be four days away from a Senate vote, with banks pushing back and arguing that industry frameworks should resemble traditional finance security standards. Exchanges facing compliance pressure have an incentive to reduce internal security weaknesses, including failures caused by phishing.

Routine testing can also help security teams update training as attacker tactics change. Recruitment lures, event invitations and credential prompts are useful test cases because they resemble ordinary business communications and can target employees outside engineering or security departments.

Consequences for Failed Tests

Binance’s process goes beyond awareness messaging. Employees who fail simulated phishing exercises must complete additional training, while repeated severe failures may influence performance assessments or result in dismissal. That creates a formal disciplinary element around cybersecurity behavior, rather than treating phishing tests only as educational exercises.

The policy also raises questions about workplace morale, privacy and reporting culture. A system in which employees fear job consequences for security mistakes could encourage more cautious behavior, but it could also create a culture in which errors are concealed rather than reported. That type of reporting gap can itself become a security concern, because early reporting is often important when a real credential-harvesting attempt or account compromise is suspected.

Binance has not publicly disclosed how many employees, if any, have been terminated under the program. However, the existence of the Red Team program and its monthly schedule indicate that the company treats phishing risk as persistent and evolving. The simulated scenarios also appear to reach multiple departments, including recruitment-related lures for human resources staff and fraudulent event invitations for marketing teams.

Limited Public Disclosure Across the Industry

No other major cryptocurrency exchange has publicly disclosed a comparable monthly employee phishing program with similar disciplinary consequences. Many companies in the sector are likely to conduct internal phishing simulations, but Binance’s confirmation through its chief security officer makes its approach more visible.

Other exchanges may use less aggressive internal testing, or they may simply avoid public discussion of employee-focused security exercises. Public disclosure can also signal that staff at digital asset firms are high-value targets for attackers, a point already widely recognized in cybersecurity.

As institutional activity expands across centralized crypto venues, operational security becomes increasingly important. Firms trading large spot and derivatives positions require confidence that exchange employees cannot be tricked into surrendering access. During periods of elevated market activity, such as the reported 18% spike in SUI linked to institutional staking, internal security failures could carry greater operational consequences.

The growth of tokenized real-world assets also increases the importance of intermediary security. Tokenized treasuries, private credit and other on-chain assets have reportedly crossed $20 billion in value. Infrastructure supporting those assets is often managed through centralized intermediaries, including exchanges. If an employee at such an intermediary were compromised in an actual phishing attack, the consequences could extend beyond a routine password reset.

Unanswered Questions

The long-term effectiveness of Binance’s Red Team program cannot be assessed from public information. The company has not released data showing improvements in employee phishing resistance or any correlation with reduced internal security incidents. Such metrics are often kept private, but their absence leaves outside observers unable to determine whether the program has materially improved security outcomes.

Another unresolved issue is whether Binance applies similar testing to contractors and third-party service providers. Vendors and outside partners may have privileged access to internal systems while remaining outside standard employee performance and disciplinary structures. Many cyber incidents begin through third-party access rather than direct compromise of the primary organization.

For now, Binance’s program shows how cryptocurrency security practices are moving beyond code audits and wallet protections toward routine operational controls, including training, testing and disciplinary processes tied to failed phishing simulations.