Binance Fires Staff Over Phishing Tests as India Bans BitChat
The crypto exchange treats security failures as termination offenses while New Delhi orders GitHub to remove Jack Dorsey's offline messaging app.
Binance employees face termination if they repeatedly fall for fake phishing emails sent by the company's own security team, while India's government ordered GitHub to remove Jack Dorsey's BitChat app within three hours, citing national security concerns.
The dual developments highlight contrasting approaches to digital security: one corporation weaponizing social engineering against its workforce to harden defenses, and one state moving swiftly to suppress decentralized communication tools that operate beyond traditional internet infrastructure.
Binance's Internal Red Team
Binance runs monthly simulated phishing attacks against its own staff as part of an aggressive security hygiene program, according to Jimmy Su, the exchange's Chief Security Officer.
"We do phishing attacks on our own employees on a monthly basis just so we understand if our security hygiene is improving," Su said.
The internal red team's tests carry real consequences. Employees who repeatedly fail the simulations can be fired, treating security lapses as performance issues rather than training opportunities. The policy reflects the cryptocurrency industry's heightened vulnerability to social engineering attacks.
India Moves Against BitChat
The Indian Cybercrime Coordination Centre (I4C) ordered GitHub to remove BitChat's source code repository and Android download page within three hours of identifying the app, according to multiple Indian outlets.
BitChat is a decentralized messaging application that uses Bluetooth mesh networking to transmit messages without requiring an internet connection. The app gained attention during recent protests in India, where demonstrators sought communication tools that could operate during internet shutdowns—a tactic authorities have deployed repeatedly to disrupt organizing.
The government cited national security concerns in its takedown order. Business Standard reported the directive came over fears that encrypted, offline-capable messaging could hamper law enforcement monitoring and enable coordination beyond state oversight.
GitHub has not publicly commented on whether it complied with the removal order.
Decentralization Meets State Control
BitChat's architecture represents a growing category of peer-to-peer tools designed to function independently of centralized infrastructure. By routing messages through nearby devices via Bluetooth, the app creates ad-hoc networks that persist without cellular data or WiFi access.
For India's government, this capability presents a direct challenge to existing surveillance and content moderation frameworks. Internet shutdowns become ineffective when citizens can communicate through mesh networks that bypass traditional chokepoints.
The Binance security program, by contrast, demonstrates how private firms are internalizing threat models once reserved for nation-states. By treating employees as potential attack vectors and testing them continuously, the exchange acknowledges that technical defenses alone cannot stop determined adversaries who target human weaknesses.
Both cases underscore a broader tension: as digital tools become more resilient and decentralized, institutions—whether corporate or governmental—are responding with stricter controls over the people and platforms within their reach.