Analysts at BitMEX Research have issued an urgent warning to the cryptocurrency community regarding a sophisticated new scam campaign specifically targeting early Bitcoin holders, particularly those with dormant wallets dating back to 2011.
According to the intelligence gathered by the firm, the fraudulent operation exploits long-dormant blockchain addresses by injecting deceptive transactions and misleading messages directly into the ledger. The attackers utilize OP_Return outputs—an optional field within Bitcoin transactions that allows users to append arbitrary data to the blockchain—to broadcast their malicious prompts to unsuspecting holders or onlookers monitoring these historical addresses.
In one prominent and well-documented case highlighted by the researchers, the bad actors focused their efforts on the infamous "1Feex" wallet. This high-profile address currently holds approximately 80,000 Bitcoins that are widely believed to have been stolen during the historic security breach of the defunct exchange Mt. Gox.
To execute the scheme, the attackers crafted a customized on-chain message linked to the transaction data, directing prospective victims to a fraudulent, newly minted website designed to meticulously impersonate the operations of the historic investment banking firm Salomon Brothers.
Upon visiting the fraudulent platform, visitors are greeted with a fabricated legal notice asserting that the targeted cryptocurrency wallet is classified as "lost or abandoned." The site then prompts supposed owners or claimants to step forward and prove their rightful ownership of the funds.
To complete this verification process, the scammers ask users to either sign an on-chain message using their private keys or submit sensitive personal documentation through a web-based contact form hosted on the malicious domain.
Adding a false sense of urgency to coerce compliance, the legal notice warns that if no official response or ownership claim is registered by October 5, the wallet will be formally deemed abandoned under a set of manufactured legal terms.
Fake Legal Claims and Impersonation Tactics
Investigative analysis conducted by BitMEX revealed that the website hosting the fraudulent claims bears no legitimate connection whatsoever to the real Salomon Brothers or its historical leadership structure.
While the perpetrators attempted to manufacture an aura of corporate legitimacy by displaying a list of real individuals who genuinely worked at the prestigious firm during the 1980s, none of those former professionals have any affiliation with the spurious entity running the campaign.
The research platform noted that this deceptive approach bears striking tactical similarities to earlier, controversial schemes. Specifically, observers pointed out thematic parallels to past legal campaigns associated with figures like Calvin Ayre, who previously financed various legal maneuvers involving the exact same high-profile Bitcoin address.
Emphasizing the deceptive nature of the setup, BitMEX Research stated that the links between the shell company and the newly surfaced website are entirely fabricated.
"The links between this company and this website are fake," BitMEX Research stated. "There is a page with an advisory board that contains real people who worked at Salomon Brothers in the 1980s, however, these people seem to have no link to this new spurious entity."
Members of the broader cryptocurrency community have also weighed in on the mechanics of the attack, pointing out glaring technical and logical flaws in the scammers’ premise. Industry commentators noted that if a legitimate wallet owner ever needed to prove activity on an old address, they could simply move a minute, negligible amount of Bitcoin to establish control rather than transferring a full balance or handing over sensitive cryptographic keys.
This glaring discrepancy has led many security analysts and blockchain sleuths to suspect that the campaign is not genuinely designed to adjudicate property rights, but is instead part of a much broader social engineering effort. The ultimate objective appears to be the accumulation of sensitive personal information and private key data under the guise of official legal proceedings.
Security experts at BitMEX have strongly emphasized that users, asset holders, and observers should completely avoid interacting with the contact form or disclosing any personal details or cryptographic signatures to the platform.
The sudden emergence of these tailored, historical-target scams underscores the escalating complexity and evolving tactics characterizing crypto-related fraud in the modern digital asset landscape.
The threat landscape has grown increasingly aggressive over recent cycles. Data tracking broader industry security metrics indicates that in the first half of 2025 alone, hackers and malicious actors successfully stole over $2.1 billion across 75 separate security incidents. This staggering figure represents an approximate 10% rise in total stolen funds compared to the exact same period in the previous year, highlighting the persistent challenges facing digital asset security and participant protection.
