Binance New Co-CEO’s WeChat Hacked to Promote Meme Coin, CZ Warns

Binance founder Changpeng Zhao has warned users that the WeChat account of the exchange’s new co-chief executive, Yi He, was hacked and used to promote a meme coin.

Zhao said the attackers used Yi He’s account to push meme coin promotions and urged followers not to engage.

He wrote that “Web2 social media security is not that strong. Stay safu!” and added, “I hope the next one isn’t my account. I haven’t used WeChat for many years. I also won’t directly promote any meme CA. Please everyone stay safe.”

Meanwhile, Yi He said she stopped using WeChat long ago and that the linked phone number was taken over, leaving her unable to regain access.

Leadership Transition At Binance Accompanied By Meme Coin Exploit

The incident comes about a week after Binance elevated Yi He to co-CEO during a recent Binance Blockchain Week event.

Co-founder Richard Teng described her as a “driving force since day one,” crediting her with shaping the exchange’s culture, vision and user focus, and said her promotion marked a natural evolution of leadership as Binance pursues its goal of reaching one billion users.

On-chain data suggests the hack was quickly turned into a trading scheme. Blockchain analytics account Lookonchain described the incident as a straightforward hacked account pump and dump built around a little-known token called Mubarakah, or MUBARA, which trades on decentralized exchanges.

Fake Endorsement Triggered Sudden Surge In MUBARA Price And Volume

According to that analysis, an attacker gained access to Yi He’s WeChat and used the apparent endorsement to stir fear of missing out around MUBARA.

Two new wallets, created only hours earlier, began accumulating the token via PancakeSwap and other decentralized exchange routes, spending a total of 19,479 USDT to buy about 21.16M MUBARA.

As the WeChat promotion circulated and traders chased the move, the token’s price and volume spiked sharply on Dexscreener charts.

Attacker Sold Into The Pump After Liquidity Flooded In

Once liquidity arrived, the wallets started to sell into the rally. Lookonchain estimates that the attacker has already sold 11.95M MUBARA for 43,520 USDT and still holds 9.21M tokens worth roughly $31,000, putting the profit near $55,000 with more tokens left to unload.

In practical terms, the attacker front-ran the market by buying early, used the compromised account to pull in retail demand, then dumped a large chunk of the position into that surge, leaving later buyers exposed to a rapid reversal in price.

The remaining holdings give the hacker additional room to sell if liquidity persists.