Binance's chief security officer Jimmy Su discussed employee phishing tests in July, months before the exchange's October 29 theft. Binance's November 3 preliminary report put the affected assets at approximately $6.34 billion and traced part of the intrusion to a fake recruitment assignment. The comparison exposes a security problem: recognizing an attack method still leaves the task of restricting the damage after it succeeds.
The July interview coverage confirms Su described internal phishing exercises, not that he predicted the eventual attack's full technical sequence.
July's drills tested employee judgment
Cointelegraph's July 28 interview coverage said Binance had been running simulated phishing attacks against employees for four years. Its internal red team attempted to expose weaknesses, and employees who failed received remedial training. Repeated failures could lead to dismissal.
That program treated employee behavior as something the exchange could test and improve. A simulated attack gives a security team evidence about whether someone recognizes a suspicious request before following it. Training then addresses the mistake.
Su's comments raise a useful question: whether those exercises measured the right outcome. Recognizing a lure and preventing a downloaded program from reaching sensitive systems are separate tests. An employee can perform poorly in a drill without causing a financial loss, provided technical restrictions stop the intrusion.
Conversely, a favorable training record is an incomplete basis for judging the security of financial infrastructure. The July account described a program for improving staff awareness. Assessing the infrastructure also requires examining the permissions available to a compromised computer and the checks applied to a transaction.
The assignment reached wallet infrastructure
Binance's preliminary account described a September recruitment process involving two interviews. Near the end of the second interview, an engineer downloaded an assignment onto a work computer. Malicious code ran during setup.
On October 20, the attacker used that compromised computer and an internal AI tool to reach two wallet engineers' systems. Stolen deployment credentials subsequently helped the attacker access wallet-signing operations and initiate transactions outside normal withdrawals.
The coding assignment became consequential because of the access that followed it. Treating the incident solely as an employee's recruitment mistake would leave the later movement between systems unexplained.
Binance said it rebuilt the affected wallet system and internal AI tool, replaced devices, and disabled affected credentials. It also commissioned an independent cybersecurity review. Those measures address several points along the reported attack path.
Recruitment creates a reason to run unfamiliar code
Microsoft's November 2024 research provides a directly relevant precedent. Its investigators described a North Korean group, Sapphire Sleet, posing as recruiters on professional networking services.
The supposed recruiter directed a candidate to a skills-assessment website under attacker control and supplied login credentials. Downloading the assessment code installed malware and gave the attacker access to the device.
A technical test creates a plausible reason for a developer to handle unfamiliar software. Providing a dedicated website and a login also makes the interaction resemble an organized hiring process. In this setting, the request to download code fits the task the candidate believes they are completing.
Microsoft documented a related approach involving supposed investors. Targets encountered a broken online meeting and received a script presented as a connection repair. Running it downloaded malware.
In both approaches, an ordinary professional activity produces a request to execute software. For security teams, that suggests exercises should test the moment a conversation becomes a software-installation request. Assessing the recruiter's presentation alone leaves the dangerous action further along in the exchange.
Device separation was already explicit guidance
The FBI's September 2024 advisory warned that tailored recruitment campaigns could compromise even people familiar with cybersecurity. It identified pre-employment tests involving unfamiliar packages, scripts, or code repositories as warning signs.
Its guidance was specific: avoid running employment tests on company laptops. If execution is necessary, use a virtual machine on a device disconnected from the company environment, or equipment supplied by the tester.
This separates a candidate's willingness to attempt an assignment from the employer's exposure to that assignment. It also gives staff a workable response when a hiring process requires executable code.
The advisory recommended multiple authentication factors and approvals from separate, unconnected networks before company financial assets move. That recommendation addresses the financial consequence after an initial compromise.
For crypto users, the custody implication is concrete. Exchange balances depend partly on an operator's controls over staff devices and transaction authorization. Evaluating that dependency requires more than counting phishing exercises.
Overview
Su's July comments show Binance was testing employee resistance to phishing before the theft. The preliminary incident report describes a malicious assignment followed by access to wallet infrastructure. Together, these accounts show why awareness training and restrictions on compromised devices require separate assessment. The FBI's existing guidance already called for employment tests to stay off company-connected equipment.
