Analysts at BitMEX Research have raised a critical security alarm regarding an increasingly sophisticated cryptocurrency scam targeting early Bitcoin holders, with a specific focus on long-dormant addresses dating back to the foundational era of the network in 2011.
According to the blockchain intelligence and research firm, the emerging fraudulent campaign relies on exploiting inactive historical addresses by injecting false transactions and misleading notices directly into the blockchain. The attackers utilize OP_Return outputs—an optional field within Bitcoin transactions capable of carrying arbitrary data—to broadcast deceptive payloads to anyone monitoring these vintage wallets.
In one of the most prominent documented cases of this campaign, the malicious actors targeted the widely known "1Feex" wallet address. This specific address currently holds approximately 80,000 Bitcoins, which are historically believed to have been tied to the major exchange exploit involving Mt. Gox. The attackers crafted a specialized on-chain message designed to catch the attention of anyone tracking the address, embedding a digital trail that lures potential victims to a fraudulent website meticulously impersonating the defunct investment firm Salomon Brothers.
The counterfeit website presents visitors with an official-looking legal notice, falsely claiming that the targeted cryptocurrency wallet is considered "lost or abandoned." To fabricate a sense of urgency and false legitimacy, the platform invites supposed rightful owners or claimants to verify their identity and ownership. The site instructs targets to prove their claim either by signing an on-chain cryptographic message using the wallet’s private key or by submitting sensitive personal and financial documentation through an online contact form. Furthermore, the fraudulent notice establishes a ticking clock, warning that if no response is received by October 5, the wallet will be officially deemed legally abandoned under fabricated legal frameworks.
Fake Legal Claims and Spurious Corporate Ties
Investigative analysis conducted by BitMEX Research quickly dismantled the credibility of the website, revealing that it bears no authentic or authorized connection to the real Salomon Brothers or its historical leadership structure. While the fraudulent web page attempts to manufacture trust by displaying a directory of real individuals who genuinely worked at the prominent firm during the 1980s, investigators confirmed that none of these former professionals have any association with this new, spurious entity.
The research platform noted that the overall modus operandi bears a striking resemblance to previous controversies. Specifically, the approach evokes memories of earlier disputes involving controversial figures such as Calvin Ayre, who previously funded legal actions surrounding the exact same high-profile Bitcoin address.
In a public statement detailing the threat, BitMEX Research cautioned the broader cryptocurrency community about the deceptive nature of the initiative:
"The links between this company and this website are fake. There is a page with an ‘advisory board’ that contains real people who worked at Salomon Brothers in the 1980s, however, these people seem to have no link to this new spurious entity."
The warning quickly drew reactions from across the broader cryptocurrency community, where experienced operators and blockchain analysts weighed in on the mechanics of the attack. Commentators pointed out that a legitimate wallet owner attempting to prove activity or operational control would simply need to execute a standard transaction moving a negligible amount of Bitcoin, rather than interacting with suspicious external web forms or transferring entire balances.
These observations have led security analysts and industry observers to suspect that the campaign is not actually about recovering lost funds, but is instead part of a much broader, highly targeted social engineering scam. The ultimate objective appears to be gathering sensitive private information, personal data, or cryptographic signatures under the guise of formal legal compliance.
Security experts at BitMEX have strongly emphasized that users, asset administrators, and historical wallet holders should completely ignore these on-chain alerts, avoid visiting the fraudulent web portal, and refrain from submitting any personal documentation or interacting with the contact forms.
The sudden emergence of these elaborate social engineering tactics highlights the expanding sophistication and frequency of crypto-related fraud in the digital asset ecosystem. Financial crimes and security breaches continue to plague the sector as malicious actors adapt their strategies to target both institutional holdings and legacy accounts. Industry reports indicate that in the first half of 2025 alone, hackers and cybercriminal syndicates successfully stole over $2.1 billion across 75 distinct security incidents, representing a concerning 10% rise in total stolen funds compared to the same period in the previous year.
