Binance runs simulated phishing attacks against its employees every month to reduce social engineering risks. 

Chief security officer Jimmy Su said the exchange’s red team creates fake attacks to test whether staff recognise suspicious messages, links and requests. Employees who fail must complete follow-up training. Repeated failures can also affect performance ratings and may lead to dismissal.

The programme targets human errors that attackers use to enter crypto companies. Binance has operated the drills for three to four years, according to Su. He said the company’s security habits had improved during that period. Binance reports 323 million registered users, while DefiLlama tracks about $137.5 billion in assets linked to the exchange.

Wise plans to submit a new application for a U.S. national trust bank charter under the GENIUS Act after the Office of the Comptroller of the Currency rejected its first bid.

The July 21 decision ended the payments company’s effort to create Wise National Trust in Austin, Texas. Wise disclosed the outcome on July 24 and said its current U.S. services continue without change. The company still operates through money-transmitter licences across 48 states and four territories.

The new filing will use the federal framework for payment stablecoins rather than the structure in Wise’s original June 2025 application. Wise said the earlier plan relied on access to Federal Reserve payment systems that is no longer practical. Its London-listed shares fell as much as 10% after the denial became public. Wise said it had strengthened financial-crime controls since filing the original plan and would address the regulator’s findings in its next submission.

OCC rejects Wise application over compliance concerns

The OCC’s decision said Wise did not show that the proposed trust bank could meet U.S. legal and regulatory requirements. The regulator focused on weaknesses in anti-money laundering and countering the financing of terrorism controls. It also said Wise U.S. had a record of failing to meet rules that apply to money services businesses. The proposed bank planned to rely heavily on Wise U.S. and other group companies for compliance work.

The regulator also questioned the experience of the proposed directors and managers. It said the team did not show enough knowledge of national banking rules, fiduciary services, or AML/CFT operations. Wise National Trust had planned to offer multi-currency stored-value accounts, payment processing, and fiduciary services. The OCC stated that approval would conflict with its charter policies. However, the decision does not stop Wise from filing another application after addressing the issues.

Wise shifts its plan toward the GENIUS Act

Wise gave a separate reason for changing course. The company said the Federal Reserve has generally paused account access for uninsured trust banks while it develops a new payment-account policy. “With the Federal Reserve generally pausing account access for an uninsured trust bank, the approach in our application became non-viable,” Wise said. The original plan aimed to let Wise settle U.S. dollar payments more directly and reduce its reliance on partner banks.

Wise now plans to apply under the GENIUS Act, which created a federal licensing and supervision system for payment stablecoin issuers. The company has not said it will launch its own stablecoin. William Blair analysts also said they do not expect a major change in Wise’s position. They described the company as “agnostic of the rail,” meaning it remains focused on lowering cross-border payment costs whether transfers use traditional systems or digital assets.

Stablecoin rules remain unfinished

The GENIUS Act became law in July 2025. It sets reserve, redemption, reporting, consumer protection, and compliance requirements for approved payment stablecoin issuers. The law is due to take effect on January 18, 2027, or 120 days after regulators publish final rules, whichever comes first. The OCC published its main proposed rule in March, while Treasury later proposed AML and sanctions standards.

Final rules were still pending when Wise announced its new plan. As crypto.news reported, regulators missed the July 18 rulemaking deadline, leaving key details unresolved. Wise will need to explain what activities its new entity would conduct, how it would use stablecoins, and how it would meet the stricter AML/CFT standards planned for permitted issuers. A new application must also explain how the charter would work without the unrestricted Federal Reserve access assumed in the earlier model.

Wise joins a wider U.S. charter race

Wise is entering a crowded federal licensing process. The OCC has approved several digital asset companies for national trust charters during the past year.Circle received final approval in July 2026 after gaining conditional approval in December. Ripple, Paxos, BitGo, Fidelity Digital Assets, Crypto.com, Bridge, and Coinbase have also received conditional decisions or entered the process.

The approvals have drawn opposition from banking groups and some lawmakers. Crypto.news reported that the Bank Policy Institute retained outside lawyers while considering a challenge to the OCC’s trust-charter policy. Wise’s case differs because the regulator issued a direct denial tied to its compliance record and management plan. The new GENIUS Act filing may offer a different route, but it will still require Wise to satisfy the OCC’s standards before gaining a charter.

BitMart has started a phased shutdown of its global cryptocurrency exchange after reviewing its operating conditions, market environment, and future strategy. 

According to the official shutdown notice, the exchange stopped new registrations, cryptocurrency and fiat deposits, and new spot orders from 01:30 UTC on July 26. Futures accounts entered reduce-only mode, while copy trading, grid trading, API trading, and other automated services began winding down.

The exchange will end all spot, futures, and other trading services at 01:00 UTC on August 26. However, the full platform will not close on that date. BitMart plans to terminate trading-platform operations at 15:59 UTC on January 31, 2027. Users will retain limited account access for a period after that date to review records and submit withdrawals.

BitMart sets withdrawal and position deadlines

BitMart told users to close all positions before 01:00 UTC on August 26 and recommended submitting withdrawals before 05:00 UTC the same day. Withdrawals remain open, but requests may face identity, source-of-funds, wallet ownership, sanctions, Travel Rule, and security reviews. Heavy demand or network congestion may extend processing times.

The exchange asked customers to cancel open orders, redeem eligible Earn, staking, and lending products, and download account records. BitMart may settle any futures positions still open when trading ends using its mark price, index price, or other applicable rules. Users who miss the recommended withdrawal period will enter a separate process that BitMart plans to explain later.

BMX falls as traders react to the shutdown

BMX, the exchange’s platform token, fell by around 63% during the 24 hours surrounding the announcement. BitMart’s own market page showed a decline of about 64.9% at one stage, while CoinGecko’s BMX page placed the token near $0.164 on July 26 with about $6.1 million in daily volume. The sharp move reflected the token’s close link to exchange activity.

BMX provides trading-fee discounts and other platform benefits. The planned end of trading removes much of that direct use. Price readings varied across trackers because the market moved quickly and platforms used different update times. CoinGecko data placed the token’s market value near $55.6 million on July 26, down from more than $100 million earlier in the week.

Closure follows recent service restrictions

BitMart did not identify a single event behind the shutdown. Its notice referred only to “operating conditions, market environment, and future strategic direction.” The exchange did not state that it had entered insolvency, and it did not connect the decision to a security incident, regulatory order, or lack of customer assets. Users therefore still lack a detailed financial explanation.

The decision followed several service changes. BitMart suspended its automated market-making bot on July 24 and returned users’ principal and earnings to spot accounts. It also ended spot margin trading, with forced liquidation scheduled for July 26. On July 23, the exchange told remaining U.S.-linked users to close positions and withdraw by August 8 during a compliance review.

BitMart follows other crypto platform closures

The announcement came three days after BitMEX said it would close its derivatives exchange on September 23 following a strategic review. BitMEX stopped new registrations and set August 26 as the date when customers could no longer open new positions. Odos also announced plans to shut its decentralized exchange aggregator on July 30, although the platforms gave different reasons and timelines.

BitMart entered the market in 2017 and grew through a wide selection of smaller tokens. A 2021 Series B round led by Alexander Capital Ventures valued the company at more than $300 million. Fenbushi Capital had made an earlier investment in 2019. Days after the Series B announcement, attackers compromised two hot wallets and stole assets valued at about $150 million by BitMart, while outside estimates reached $196 million.

BitMart said at the time that it would use its own funds to compensate affected customers. The shutdown notice did not link the wind-down to that breach, which occurred nearly five years earlier. In May 2026, BitMart said “all platform operations are running normally” while responding to online concerns about withdrawals and risk controls. It also said it planned to publish proof of reserves after completing security preparations.

The exchange now warns that scammers may exploit the shutdown. BitMart said it will not charge an expedited withdrawal fee or ask for passwords, two-factor codes, private keys, or recovery phrases. It advised users to rely on its official website, app, registered emails, and support system. Customers must also check networks and addresses before transferring funds.

• BlueNoroff scans browser wallets before deciding which fake meeting targets should receive its malware payload.
• Hijacked Telegram accounts help attackers contact trusted industry peers and extend the campaign through victims.
• The phishing kit supports Windows and macOS, stealing browser keys, system data, and Telegram sessions.

North Korea-linked hacking group BlueNoroff is using fake Zoom and Microsoft Teams meetings to profile cryptocurrency users before delivering malware. 

Cybersecurity firm JUMPSEC said it recovered and analysed source code from an active phishing kit after its operators exposed JavaScript source maps on live infrastructure. The files showed separate Zoom and Teams lures, wallet-scanning tools, operator controls and malware delivery paths for Windows and macOS.

Uniswap Labs has launched Permissioned Pools on Uniswap v4, adding onchain access checks for regulated assets that cannot trade freely between every wallet. 

The open-source hook standard lets approved users swap tokenized funds, securities, equities and other restricted assets through automated market maker pools. Uniswap announced the product on July 23, 2026, after working with firms that issue and manage regulated onchain assets. It keeps issuer compliance controls visible and enforceable onchain.

Upbit has added Morpho (MORPHO) and Euler (EUL) to its Korean won market, expanding direct KRW trading for two Ethereum-based decentralized lending projects in Korea. 

MORPHO/KRW opened on July 25 at 6:00 p.m. KST, while Upbit planned EUL/KRW for July 26.

However, Upbit changed Euler’s launch timetable shortly before trading. The exchange moved the start from 12:00 p.m. to 2:00 p.m. KST on July 26. The notice said, “The trading support start time for EUL will change.” Deposits and withdrawals for both assets remain limited to the Ethereum network. The listings also broaden access beyond existing BTC and USDT pairs already available for both assets on Upbit.

Binance says it has been running internal, simulated phishing attacks against its own staff for several years—testing how well employees resist social engineering attempts and tying repeat failures to remediation training and performance consequences. The exchange’s chief security officer, Jimmy Su, described the program as a way to measure whether “security hygiene” is improving inside a growing organization.

Su told Cointelegraph that Binance’s internal red team performs phishing simulations on a monthly basis. Employees who fail receive remediation training, while continued poor performance can affect their performance review ratings and, in extreme cases, lead to dismissal.

Key takeaways

• Binance conducts monthly phishing simulations via an internal red team, according to its chief security officer Jimmy Su.
• Failed phishing tests are followed by remediation training, aiming to improve employees’ security habits over time.
• Results can influence performance reviews; repeated failures may lower ratings to the point that employment risk increases.
• Su says Binance has run these simulated attacks for roughly three to four years, with security hygiene improving compared with earlier stages.
• The described tactics reflect broader industry risk: social engineering continues to be a major driver of crypto security incidents.

How Binance tests resistance to social engineering

Binance’s approach centers on realism: the red team acts as an attacker to probe the company’s human layer, not just technical controls. Su said the simulations are designed to show whether employees have become more vigilant over time, adding that the program has been running for about three to four years.

“We do phishing attacks on our own employees on a monthly basis just so we understand if our security hygiene is improving,” Su told Cointelegraph. The goal, he said, is to spot weaknesses early—before malicious actors can exploit them in real incidents.

“The ones that have failed it, we will do remediation training.”

Su also said that early on, security hygiene “left a lot to be desired.” But after continuing the internal testing for a sustained period, Binance has seen meaningful improvement. That long-running cadence matters because human error is rarely solved through a one-time training session; it often requires repeated exposure, feedback, and accountability.

Escalating accountability: training and performance reviews

Binance’s internal program isn’t only about education—it’s also about incentives. Su stated that employees are encouraged to perform well because simulation results are reflected in performance reviews.

“If someone repeatedly fails the phishing-simulation attack, that will negatively impact their rating. That’s the incentive to be vigilant.”

He added that repeated, severe failures could cause a person’s rating to “bottom out,” which could ultimately lead to dismissal. While exact thresholds or timelines were not specified, the direction is clear: Binance treats recurring susceptibility to phishing as a measurable risk rather than a purely training-based issue.

For employees and managers, this changes the information security conversation. Instead of treating phishing defenses as optional training, the simulations become part of how the organization assesses readiness—suggesting a shift toward continuous security evaluation.

The tactics: recruiter lures and Zoom-style schemes

Su described at least one scenario used in the red team’s simulations: the team poses as job recruiters. That reflects a common pattern in real-world phishing—using credible context and urgency to lower an employee’s guard, especially when the target might be inclined to respond to hiring-related messages.

He also referenced well-known social engineering techniques that have circulated widely in the crypto ecosystem, including “Zoom meeting attacks,” in which attackers try to get victims to install malware disguised as a meeting update. These attacks often begin with a lure such as a fake job opportunity, and they can also use other hooks like proposed funding or partnerships.

The Binance description aligns with incidents seen across the sector. Earlier coverage cited by Cointelegraph notes that AMLBot estimated that 65% of crypto security incidents in 2025 were driven by social engineering. Separately, a major hack suffered by Drift Protocol in April was described as following a long-term social engineering campaign.

One example of the “Zoom client” pattern occurred in September 2025, when a major Venus Protocol user reportedly lost around $13 million after a malicious Zoom client compromised their computer and granted an attacker control over their account. Venus paused the protocol and used an emergency governance vote to recover the assets, later returning positions worth $11.4 million to the victim, according to the related Cointelegraph reporting referenced in the original article.

Why internal phishing testing is becoming standard in crypto

Binance’s public discussion of internal simulated phishing comes at a time when social engineering is widely recognized as a persistent—and often underestimated—attack surface in digital-asset businesses. The reason these programs can matter is that even sophisticated security stacks cannot fully prevent compromise if employees can be tricked into revealing access, installing malware, or granting approvals.

Binance is also operating at a scale where human processes can become especially important. The exchange says it has 323 million registered users, and DefiLlama estimates Binance holds $137.7 billion in assets. In environments this large, attackers have strong incentives to focus on the easiest pathway to access—often the human decision layer.

Su indicated that Binance has treated phishing resilience as an ongoing operational discipline rather than a compliance box. He described scenarios that include collecting personal information through seemingly benign interactions, such as offering free conference invites as a way to see how many targets would share details.

That emphasis on varied lures is an important point for investors and operators watching the sector: attackers adapt, and defensive training must adapt too. Simulations that only teach one “shape” of attack can become outdated quickly, while programs that rotate scenarios help test whether employees can recognize patterns rather than memorize scripts.

What readers should watch next is whether other major exchanges and custody platforms adopt similar accountability-driven simulation programs—and, crucially, whether regulators and internal auditors begin to treat phishing resistance testing as a measurable control rather than a general training activity.

Sberbank plans to launch cryptocurrency trading infrastructure and a digital depository by Dec. 1, 2026.

The system will support regulated crypto trading, custody and settlement for eligible customers in Russia.

The project follows the approval of new rules covering crypto exchanges, brokers, banks and digital depositories. Russia will introduce the wider regulatory framework on Sept. 1, 2026, while companies will receive additional time to meet licensing requirements.

Sberbank plans digital custody and off-chain records

According to Interfax, Sberbank’s digital depository will record customers’ cryptocurrency ownership and account for many transactions outside public blockchain networks. The bank will also manage active wallets for deposits, withdrawals and transfers.

Alexander Vedyakhin, Sberbank’s first deputy chairman, said the bank intends to complete the required systems before the December deadline.

“Sber plans to implement the necessary infrastructure and launch the digital depository by Dec. 1, 2026.”

Sberbank has not yet named the cryptocurrencies that its platform will support. The bank has also not disclosed fees, customer eligibility rules or withdrawal limits. These details may depend on supporting regulations that Russian authorities still need to approve.

Under the planned structure, customers could hold recorded crypto rights inside Sberbank’s system. The bank would then use its controlled wallets when customers deposit, withdraw or transfer assets to external addresses.

Russia introduces rules for investors and intermediaries

The Bank of Russia said the new framework will allow qualified and non-qualified investors to purchase cryptocurrencies through regulated intermediaries. However, different limits will apply to each group.

Non-qualified investors must pass a knowledge test before buying eligible cryptocurrencies. They may purchase up to 300,000 rubles of crypto each year through one intermediary. Public access will focus on assets that meet liquidity and market-size standards set by regulators.

Qualified investors must also complete testing, but they will have access to a wider range of assets without the same annual limit. Banks, brokers and asset managers may offer services under their existing licences and added crypto requirements.

Meanwhile, new cryptocurrency exchanges and digital repositories will require separate approval. The Bank of Russia will supervise the market and set standards for custody, accounting and customer protection.

Russia will continue to prohibit cryptocurrency payments for goods and services inside the country. However, companies may use crypto for approved cross-border settlements. Residents may also need to report some foreign crypto holdings and transactions to tax authorities.

The framework takes effect on Sept. 1, 2026. Companies covered by the new rules will have until July 1, 2027 to secure licences and bring their systems into compliance.

Sberbank expands its existing digital asset services

Sberbank has operated in Russia’s regulated digital asset sector since joining the register of information system operators in 2022. The bank has issued digital financial assets and structured products linked to Bitcoin, Ethereum and cryptocurrency baskets.

Ascrypto.news previously reported, Sberbank was preparing a crypto wallet and digital asset depository before the new framework’s launch. The report said the bank could also consider access to foreign crypto exchanges, depending on final regulatory requirements.

Sberbank has also tested cryptocurrency-backed lending. In December 2025, the bank completed a pilot loan with Russian Bitcoin miner Intelion Data. The company pledged mined cryptocurrency as collateral.

Reuters reported that Sberbank later considered offering similar loans to corporate customers. The bank said miners and companies holding digital assets had shown interest in using crypto as collateral.

The bank has also explored cryptocurrency custody services. In July 2025,Reuters reported that Sberbank had submitted proposals to the central bank on storing Russian customers’ crypto assets through regulated banking infrastructure.

Russian financial companies prepare for crypto trading

Other Russian financial institutions are also preparing services under the new framework. According to crypto.news, VTB and T-Bank were developing digital depository services, while Moscow Exchange was considering regulated cryptocurrency operations.

Alfa-Bank has also tested limited crypto services and custody tools. These projects show that large Russian financial groups are positioning their systems around the new rules before the July 2027 licensing deadline.

The regulated market will divide responsibilities among banks, brokers, exchanges and repositories. Brokers may process customer orders, while exchanges provide trading services. Digital repositories will record customer rights and custody arrangements.

Sberbank’s Dec. 1 launch target places its project within the regulatory transition period. Before opening the service, the bank must complete its wallet, trading, accounting and custody systems. It must also publish supported assets, fees and customer access requirements.