Analysts at BitMEX Research have raised a critical security alarm regarding a sophisticated new scam targeting early Bitcoin holders, with a particular focus on long-dormant wallets dating back to 2011. The campaign highlights the evolving tactics employed by malicious actors in the digital asset ecosystem, leveraging on-chain data manipulation and elaborate social engineering to target high-value, inactive crypto assets.
According to the intelligence gathered by BitMEX Research, the scam systematically exploits long-dormant blockchain addresses by injecting false transactions and misleading messages directly onto the ledger. Attackers are utilizing OP_Return outputs—an optional field within Bitcoin transactions capable of carrying arbitrary data—to transmit their malicious instructions and URLs straight to the blockchain history of these ancient addresses.
In one prominent and well-documented case analyzed by the research firm, the perpetrators targeted the famous “1Feex” wallet. This specific address holds approximately 80,000 Bitcoin, a massive cache believed to have been illicitly acquired during the infamous Mt. Gox exchange compromise from years prior. The attackers crafted a malicious transaction carrying a message designed to lure anyone monitoring or controlling the address toward a fraudulent website meticulously designed to impersonate the defunct Wall Street investment firm Salomon Brothers.
Fake Legal Claims and Improvised Deadlines
Upon visiting the fraudulent portal, targeted individuals are confronted with an authoritative-looking legal notice. The fake document asserts that the long-dormant wallet is legally considered “lost or abandoned” under fictitious legal frameworks. To manufacture urgency and panic, the site invites supposed rightful owners or claimants to step forward and prove their ownership.
The mechanism demanded by the scammers requires victims to either sign an on-chain message utilizing the wallet’s sensitive private key or submit exhaustive personal identification and documentation through an official-looking web contact form. To further coerce compliance, the fraudulent notice imposes a strict deadline, warning that if no response is received by October 5, the wallet will be officially and permanently deemed legally abandoned, stripping the holder of any theoretical recourse.
However, a closer inspection by BitMEX Research revealed that the web portal bears no credible or legitimate connection to the real Salomon Brothers or its historical leadership structure. While the fraudulent operators attempted to establish a veneer of authenticity by publishing a list of genuine individuals who actually worked at the historic investment firm during the 1980s, none of these former professionals have any known association with this newly emerged and spurious entity.
The research firm drew parallels between this current wave of attacks and earlier, controversial maneuvers involving figures such as Calvin Ayre, who previously funded distinct legal actions surrounding the exact same high-profile Bitcoin address. Highlighting the complete lack of institutional legitimacy behind the website, BitMEX Research stated in a public advisory that the supposed ties between the historical company and the online portal are entirely fabricated.
"The links between this company and this website are fake," BitMEX Research noted. "There is a page with an ‘advisory board’ that contains real people who worked at Salomon Brothers in the 1980s, however, these people seem to have no link to this new spurious entity."
Broader Community Reactions and Social Engineering Concerns
The cryptocurrency community quickly mobilized to analyze the threat, with various developers and veteran security analysts weighing in on social media platforms. Industry observers noted that a legitimate wallet owner wishing to prove activity or operational control would logically execute a minor, low-risk transaction—such as moving a negligible amount of Bitcoin to a fresh address—rather than engaging with a dubious third-party legal portal or exposing their private keys.
This glaring operational discrepancy has led security researchers and community members to suspect that the campaign is not a genuine legal proceeding, but rather a calculated social engineering effort. The overarching objective appears to be the extraction of sensitive personal data, credential harvesting, or the tricking of unsuspecting holders into exposing master private keys under the guise of regulatory compliance or legal defense.
Security professionals have repeatedly stressed that users should exercise extreme caution, avoid interacting with unverified contact forms, and completely ignore on-chain data injections originating from unknown entities. Interacting with untrusted smart contracts or signing arbitrary messages with private keys can instantly compromise cold storage assets, leading to irreversible financial loss.
The emergence of these inventive social engineering vectors underscores the growing complexity and professionalism of crypto-related fraud. As the digital asset landscape matures, malicious actors continue to refine their methodologies, shifting away from simple phishing emails toward complex, multi-layered attacks that blend blockchain mechanics with traditional corporate impersonation.
This ongoing threat landscape is reflected in broader industry crime data. In the first half of 2025 alone, malicious actors and hackers stole over $2.1 billion across 75 separate security incidents. This staggering figure represents an approximate 10% increase compared to the losses recorded during the exact same period in the previous year, demonstrating that security vulnerabilities and sophisticated cyber threats remain a pervasive challenge for both individual investors and institutional custodians alike.
