Binance runs monthly phishing tests on staff, India orders GitHub to remove BitChat repositories

Binance says it has spent the past four years phishing its own employees every month, with repeated failures potentially leading to dismissal. In India, the cybercrime agency has ordered GitHub to disable access to three BitChat repositories within three hours, a move the Internet Freedom Foundation says is unconstitutional and a warning sign for anyone watching how governments treat encrypted and decentralized rails.

1. Binance chief security officer Jimmy Su told Cointelegraph that the exchange’s red team, its internal ethical hacking unit, runs simulated phishing attacks against employees on a monthly basis. The point is simple enough: measure whether security hygiene is improving, then send the people who fail into remediation training.
2. Su said the program has been running for four years, and staff who repeatedly fail the tests can be fired. For a crypto venue, that matters because social engineering remains one of the easiest ways into an operation that may have strong perimeter controls but still depends on humans clicking things.
3. In February, AMLBot estimated that 65% of crypto security incidents in 2025 were driven by social engineering. That is the uncomfortable part for PSPs and exchanges alike: attackers do not always need to break the encryption if they can get an employee to open the door.
4. India’s cybercrime agency ordered GitHub to disable access to three BitChat repositories within three hours, saying the decentralized messaging app could be used to bypass internet shutdowns, evade lawful surveillance and facilitate unlawful activities. The Internet Freedom Foundation (IFF) called the order unconstitutional and said it threatens free speech and open-source software.
5. BitChat, created by Jack Dorsey, routes encrypted messages between nearby devices over Bluetooth without relying on internet connectivity or centralized servers. Since its release in July 2025, it has gained traction during unrest and internet outages in Madagascar, Nepal, Uganda, Jamaica and Iran.

India also has another crypto compliance change on the table: the Central Board of Direct Taxes (CBDT) has issued guidance directing crypto exchanges to report all transactions on their platforms to the Income Tax department. For exchanges and payment partners, that is the usual story: more visibility, more reporting, and fewer places to hide the mess.