When news broke that Binance co-CEO Yi He’s old WeChat account was hacked to push the MUBARA memecoin, many focused on the celebrity aspect. However, this incident offers a crucial educational opportunity to understand how modern market manipulation works. It provides a crystal-clear look at the anatomy of a crypto pump-and-dump scheme, visible thanks to on-chain transparency.
The basic mechanism is simple: insiders buy low, use a powerful catalyst to drive up the price, and then sell high to the FOMO-driven crowd. This hack provided the perfect catalyst.
Stage 1: Pre-Buying by Insiders (The Setup)

Credit from Blockchain Lad
The data speaks for itself. On-chain analysis showed that two new wallets purchased MUBARA tokens hours before the promotional posts went live. These wallets secured their position when the price was low, spending just under $20,000 for a significant token supply. This pre-buying is the hallmark of an insider scheme. Scammers set up their initial investment well in advance to minimize their impact on the price while maximizing potential returns.
Stage 2: The Catalyst and Binance co-CEO Yi He’s Unintended Role


The catalyst in this case was the hijacked WeChat account. Because Binance co-CEO Yi He’s network includes high-level crypto figures and active traders, the posts created an immediate, credible-looking signal. Traders, operating on imperfect information and immense FOMO, rushed to buy. This external, massive demand drove the price up by nearly 700% in a short period. This rapid price increase is exactly what the pumpers need.
Stage 3: The Dump and The Lesson on Binance co-CEO Yi He’s Account

As retail traders poured money in, the attackers began their coordinated sell-off. They offloaded tokens for tens of thousands of dollars in profit, causing the price to crash. This segment highlights a critical security lesson that Binance co-CEO Yi He’s own team and CZ quickly pointed out: the reliance on weak Web2 security (like old phone number recovery for WeChat) creates a major vulnerability that impacts the supposedly secure Web3 market. For crypto users, the lesson is clear: verify everything, and never trust a token tip based solely on a high-profile name, especially if the source is not a primary, secure platform.
Why Binance co-CEO Yi He’s Old Account Was the Perfect Weapon

The attackers targeted a platform that remains highly relevant in Asian crypto trading circles (WeChat) and an account that carried immense, trusted influence. This hack perfectly illustrates the need for executives to conduct regular digital hygiene audits, ensuring all dormant accounts tied to past identities or numbers are completely secured or deleted.
