Drift

April

mirror

Venus

Real

<p class="is-style-lead">Binance runs simulated phishing attacks against its employees every month to reduce social engineering risks.&nbsp;</p><div id="cn-block-summary-block_5a736389d4901f28ba5f16297368e55c" class="cn-block-summary"><div class="cn-block-summary__nav tabs"><span class="tabs__item is-selected">Summary</span></div><div class="cn-block-summary__content"><ul class="wp-block-list"><li>Binance runs monthly phishing simulations to measure employee awareness and identify weak security habits early.</li><li>Workers who fail receive training, while repeated severe failures can lower ratings and risk dismissal.</li><li>Recruiter lures and fake conference invitations mirror scams already causing large losses across cryptocurrency firms.</li></ul></div></div><p>Chief security officer Jimmy Su said the exchange’s red team creates fake attacks to test whether staff recognise suspicious messages, links and requests. Employees who fail must complete follow-up training. Repeated failures can also affect performance ratings and may lead to dismissal.</p><p>The programme targets human errors that attackers use to enter crypto companies. Binance has operated the drills for three to four years, according to Su. He said the company’s security habits had improved during that period. Binance reports 323 million registered users, while <a href="https://defillama.com/cex/binance-cex" rel="noopener noreferrer nofollow">DefiLlama</a> tracks about $137.5 billion in assets linked to the exchange.</p><figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x"><div class="wp-block-embed__wrapper"><blockquote class="twitter-tweet"><p>Binance Runs Fake Hacks on Its Own Staff Every Month: Here's What They Keep Finding — <a href="https://t.co/2SzRtjvjRW" rel="noopener noreferrer nofollow">https://t.co/2SzRtjvjRW</a></p>— morosaki (@Morosaki) <a href="https://x.com/Morosaki/status/2081221946352537858?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">July 26, 2026</a></blockquote></div></figure><p>You might also like: <a href="https://crypto.news/wise-turns-to-genius-act-after-occ-rejects-u-s-bank-charter/" rel="noopener noreferrer nofollow"> Wise turns to GENIUS Act after OCC rejects U.S. bank charter </a></p><h2 class="wp-block-heading" id="strong-binance-ties-phishing-tests-to-staff-reviews-strong"><strong>Binance ties phishing tests to staff reviews</strong></h2><p>The red team uses methods that resemble real attacks. One test may present a fake recruiter offering a job. Another may promise free access to a conference and request personal details. The team records whether employees open the message, follow a link or share information that could expose company systems.</p><p>Su said workers who fail receive remedial training. Repeated failure “will negatively impact their rating,” he said. Severe cases may push a worker’s rating to the lowest level and result in dismissal. The policy gives employees a direct work-related reason to verify unexpected messages before responding.</p><p>Binance has described its red team as an internal group of ethical hackers that tests systems from an attacker’s point of view. The exchange also works with external researchers through bug bounty programmes. Its security model covers technical weaknesses and employee behaviour because attackers may enter through trusted accounts or devices.</p><h2 class="wp-block-heading" id="strong-social-engineering-drives-crypto-security-cases-strong"><strong>Social engineering drives crypto security cases</strong></h2><p>The drills come as social engineering causes a large share of reported crypto losses. AMLBot reviewed more than 2,500 <a href="https://blog.amlbot.com/crypto-crime-report-2025-2026-insights-from-2-500-real-investigations/" rel="noopener noreferrer nofollow">investigations</a> and found that 65% of the cases it handled in 2025 began with social engineering rather than direct software exploits. Phishing represented 18% of its cases, while device compromise accounted for 13%.</p><p>Attackers often spend days or months building trust before asking a target to open a file, approve a wallet request or run a command. This method can defeat technical controls when a worker has access to private keys, administrator accounts or internal systems. Stolen credentials can lead directly to liquid assets that move across blockchains within minutes.</p><p>As crypto.news <a href="https://crypto.news/drift-protocols-285m-hack-exposes-social-engineering-threat-to-solana-defi/" rel="noopener noreferrer nofollow">reported</a>, the April 2026 attack on Drift Protocol drained about $285 million after attackers compromised an administrator key. Researchers linked the breach to social engineering and operational security failures rather than faulty smart contracts. The attacker changed market settings and withdrawal limits before removing assets across dozens of transactions.</p><h2 class="wp-block-heading" id="strong-fake-meetings-and-job-offers-remain-common-lures-strong"><strong>Fake meetings and job offers remain common lures</strong></h2><p>Su identified fake job interviews as one scenario used in Binance’s tests. Real attackers use the same approach against developers, executives and investment teams. They may move a conversation from LinkedIn, Telegram or email into a video meeting, then claim that the victim’s camera or microphone needs an update.</p><p>North Korea-<a href="https://crypto.news/north-korean-hackers-use-deepfake-zoom-calls-to-target-crypto-professionals/" rel="noopener noreferrer nofollow">linked hackers</a> have used compromised Telegram accounts and deepfake Zoom calls to contact crypto professionals. The attackers impersonated known contacts and asked victims to install files that claimed to fix audio problems. Those files instead delivered malware capable of accessing devices, browser data and crypto wallets.</p><p>A Venus Protocol user lost about $13.5 million in September 2025 after approving a malicious transaction. <a href="https://crypto.news/venus-protocol-recovers-funds-phishing-attack-2025/" rel="noopener noreferrer nofollow">Venus paused</a> its lending platform and recovered the assets through an emergency governance process. The case showed how a user-level compromise can place assets at risk even when a protocol’s contracts remain intact.</p><h2 class="wp-block-heading" id="strong-frequent-drills-aim-to-reduce-predictable-errors-strong"><strong>Frequent drills aim to reduce predictable errors</strong></h2><p>Monthly simulations let Binance compare failure rates and update training when attackers change their methods. A single annual course may not prepare staff for new lures built around current events, trusted contacts or job offers. Frequent tests also show whether workers report suspicious messages instead of only deleting them.</p><p>However, simulations cannot remove every risk. Attackers can hijack genuine accounts, copy earlier conversations and use artificial intelligence to create convincing audio, video and written messages. Firms still need access controls, transaction limits, device monitoring and fast incident response alongside employee training.</p><p>Su said Binance’s early security habits “left a lot to be desired,” but repeated testing brought improvement. The exchange treats staff awareness as part of its wider defence system rather than a one-time compliance task. Employees still need to verify unusual requests through a separate channel before opening files, sharing information or approving transactions.</p><p>Read more: <a href="https://crypto.news/north-korea-hackers-scan-crypto-wallets-through-fake-zoom-calls/" rel="noopener noreferrer nofollow"> North Korea hackers scan crypto wallets through fake Zoom calls </a></p>

Binance tests staff monthly with fake phishing attacks

Table of Contents

crypto.news

Other articles published on Jul 26, 2026

Inside Wall Street’s Bitcoin ETF Boom: How Institutions Are Redefining Crypto Demand

BitMart Begins Global Wind-Down, Trading To End August 26

Forma to Shut Down Forma Chain and Migrate NFTs to Ethereum L1

XRP trades at $1.10, struggles to break 50 EMA resistance

Shiba Inu Price Soars 35% on a Dull Day as Whale Returns With Massive SHIB Purchase

XRP Ledger adds $2.6B as RWA inflows rank second

Join our free newsletter for daily crypto updates!