Binance's then chief communications officer claimed scammers built an AI deepfake "hologram" of him from his TV interview footage and used it in live Zoom calls to convince crypto project teams they'd had real Binance token-listing meetings. Contemporaneous August 2022 reporting said the claim lacked independent technical verification and a publicly released video or audio sample.
Social Engineering Examples·7 sources
In mid-2022, Binance's then chief communications officer publicly claimed that an unidentified scam operation had built an AI deepfake "hologram" of him using footage from prior television and news-media interviews, and deployed it in live Zoom calls with representatives of crypto and blockchain projects about supposed Binance token listings. The executive said he learned of the alleged calls indirectly after people thanked him for meetings he had not attended, and that at least four groups reported such calls. The claim was discussed in reporting published by The Verge on August 23, 2022 and Malwarebytes on August 24, 2022. The cited August 2022 reporting described the technical claim as unverified and did not provide an independent forensic analysis or released video or audio sample. No verified financial loss total is established by the cited August 2022 reports.
According to the executive's account and the contemporaneous August 2022 reporting, an unidentified group allegedly used his public television and news-interview appearances to create a synthetic video likeness and used it in Zoom calls with crypto project representatives. The cited reporting did not independently verify the deepfake mechanism or provide a video, audio, or forensic sample. The executive said initial contact occurred through Telegram and LinkedIn and that several groups reported calls with someone using his likeness. The mechanism therefore remains an allegation documented in the August 2022 disclosure, not a technically confirmed deepfake.
Lure: a Zoom call with what appeared to be Binance's actual Chief Communications Officer, discussing the prospect of getting the target's token listed on Binance, an extremely high-value, credibility-conferring opportunity for any crypto project, delivered by a real, recognizable, named executive rather than an anonymous contact. Tell (in hindsight): the "meetings" existed only in the scam targets' experience. The executive himself had no record of or memory of ever taking those calls, and he began surfacing the fraud only because targets started thanking him unprompted for sessions he never attended. Other red flags: outreach and coordination occurred off Binance's official channels (Telegram/LinkedIn rather than verified corporate contacts), and the "opportunity" centered on listing decisions the executive said he has no authority over. Evidentiary caveat: the only artifact ever produced to substantiate the deepfake claim itself is a text-chat screenshot with an anonymous party. No video/audio sample exists publicly, so the specific "deepfake" mechanism is a claim to be treated with appropriate skepticism even as the broader disclosure/warning is well documented.
Binance and the executive publicly disclosed the alleged scheme in August 2022 and urged verification through official channels. The cited August 2022 reports establish no verified aggregate financial loss figure. The disclosure event is documented, while the claimed real-time AI deepfake mechanism remained independently unverified in the cited August 2022 reporting.
This case is useful as an example of a senior executive's public claim that he was impersonated in alleged deepfake video calls for a token-listing scam. The disclosure is documented in the cited August 2022 reports, but contemporaneous August 2022 reporting did not independently verify the AI or deepfake mechanism. It is therefore best cited as an uncorroborated deepfake allegation and as a reminder to verify executive contacts through independent corporate channels.
Binance's own recommendation (and general best practice derived from the case): verify any executive's identity through official corporate channels (e.g., Binance Verify) rather than trusting a video call alone, treat "surprise" listing/business-opportunity outreach from a senior exec as a red flag worthy of independent confirmation, be skeptical of urgency/opportunity framing tied to a well-known brand name, and report suspicious contact to the company's official security/cyber-forensics team. Binance itself noted that its verification tooling is not foolproof and can be spoofed, underscoring that live video presence is no longer assumed sufficient proof of identity, especially for high-value financial asks like advance listing fees. Note: because the deepfake mechanism itself is unverified in this case, the more universally applicable lesson is procedural (independent out-of-band verification of any "surprise" executive contact) rather than a lesson about deepfake-detection specifically.
Social Engineering Examples. “Binance CCO's Alleged Deepfake 'Hologram' Listing Scam Claim (2022)”. Accessed 22 October 2026. https://socialengineeringexamples.com/binance-cco-deepfake-hologram-2022
per the executive's account, an unidentified group sourced his publicly available television and news-interview footage, material readily available given his role as a named, media-facing executive, as likely training data for a synthetic video likeness, while separately identifying crypto/blockchain project teams as plausible targets for a Binance-listing pitch.
A media-facing executive's public television and interview footage cannot realistically be suppressed, so the practical control sits downstream, at hardening how 'meetings' referencing that executive get verified, rather than trying to eliminate the source footage attackers could draw on.
consistent with the executive's broader warning of 'a recent spike in hackers pretending to be Binance employees and executives on platforms such as Twitter, LinkedIn, Telegram,' the operation likely relied on impersonation-friendly social/messaging accounts on those platforms rather than any compromise of Binance's own systems.
Proactive brand and executive-impersonation monitoring across LinkedIn, Twitter, and Telegram, paired with rapid takedown requests, shrinks the window a fake persona can operate in before being reported and removed.
targets were approached, per The Verge, on Telegram and LinkedIn with the prospect of getting their token listed on Binance, an opportunity valuable enough to a crypto project that it would justify taking an unscheduled meeting with a senior Binance communications executive.
Treat unsolicited 'listing opportunity' outreach that invokes a named executive over Telegram or LinkedIn, channels outside a company's official ecosystem, as inherently suspect, and confirm through a verified corporate channel (Binance itself pointed to its Binance Verify tool) before engaging further.
targets reported being placed on Zoom calls with what they believed was the executive himself; the executive's own claim is that this was an AI deepfake/'hologram' built from the sourced footage, though The Verge and Malwarebytes both note no video/audio sample was ever released and questioned whether real-time deepfake video was technically plausible in 2022, so a lower-tech impersonation cannot be ruled out.
Live video presence should not, by itself, be treated as proof of identity for a high-value business decision; independently calling back through a separately confirmed corporate contact defeats a synthetic-video impersonation even when the video is convincing, which is why Binance's own guidance stressed out-of-band verification over trusting the call.
having established apparent legitimacy through the video meeting, the scheme's structure (per the executive's own comparison to 'the old Nigerian prince scam') would have moved targets toward paying an upfront fee to secure the promised token listing.
Standard procurement and legal review of any upfront payment tied to a business opportunity, especially one as unusual as paying a fee to a named individual executive rather than a corporate billing channel, would flag the advance-fee structure regardless of how credible the preceding pitch appeared.
the cited August 2022 reports do not establish a verified loss or token cash-out, so no completed financial outcome is asserted here.
Once funds or tokens are paid out and converted on a public decentralized exchange, recovery is largely infeasible; the realistic control point is upstream at Stage 5, blocking the fee payment itself, since after-the-fact blockchain tracing rarely enables recovery of already-dumped assets.
Browse by what this case has in common with others in the library.
A Brighton-area kitchen fitter lost roughly £76,000, including four loans he was pressured into taking out, after a Facebook ad…
Fraudsters built a fake WhatsApp profile of WPP CEO Mark Read and staged a Microsoft Teams call, deploying an AI…
An attacker impersonated LastPass's CEO with an AI voice clone over WhatsApp, but the targeted employee spotted the red flags,…
Scheme participants posed as veteran finance professionals inside private WhatsApp investment groups to lure at least 18 U.S. retail investors…
Under Operation Tri-Force Sentinel, Dubai Police raided at least nine pig-butchering scam centers in Dubai and arrested 275 people, with…
A US Attorney's Office (EDVA) court order seized seven domains spoofing the Singapore International Monetary Exchange that pig-butchering scammers used…
Attackers phoned Twitter employees posing as IT help desk, harvested VPN credentials, and used internal admin tools to hijack 130…
DOJ alleges the Ghanaian twins and a U.S.-based co-defendant ran an AI-video-enabled romance fraud ring that used fictitious female personas…
A Taiwan-linked money courier was caught in an Austin bank sting after helping collect part of the $1,408,850 a local…
A convincing fake ChatGPT download site, openew[.]app -- reached in part via an AI-generated fake outage page rendered on a…
Under Operation Tri-Force Sentinel, Dubai Police raided at least nine pig-butchering scam centers in Dubai and arrested 275 people, with…
Fraudsters impersonating Ubiquiti's CEO and a partner at an outside law firm tricked the company's principal financial officer and controller…
Fraudsters impersonating FACC's CEO by email convinced finance staff to wire roughly EUR 50M for a fake acquisition project; EUR…
A fraudster impersonating the company's chief executive tricked a Pivotal employee into emailing back affected employees' W-2 tax data.
A smishing text and a follow-up call from a fake IT colleague talked a Retool employee out of two one-time…
A convincing fake ChatGPT download site, openew[.]app -- reached in part via an AI-generated fake outage page rendered on a…
A Russian-speaking threat actor used disposable, one-conversation ChatGPT accounts to iteratively build and debug a Go-based Windows malware family and…