Analysts at BitMEX Research have raised a critical security alarm regarding an emerging and sophisticated scam campaign targeting early Bitcoin holders, with a particular focus on dormant wallets dating back to 2011. According to the blockchain research and analytics firm, the malicious actors behind this scheme are attempting to exploit long-dormant cryptocurrency addresses by injecting fraudulent transactions and misleading, deceptive messages directly onto the blockchain.
The core mechanism of the attack relies on exploiting the OP_Return outputs of Bitcoin transactions. OP_Return is an optional scripting field within the Bitcoin protocol designed to allow users to attach a small amount of arbitrary data to a transaction. While traditionally used for legitimate purposes, such as embedding hashes or proof-of-existence data, bad actors have increasingly repurposed this field to broadcast malicious links, text prompts, and phishing vectors directly to wallet histories that are monitored by blockchain explorers and automated tracking tools.
In one prominent and well-documented case highlighted by analysts, the scammers directed their campaign at the legendary "1Feex" wallet. This high-profile address currently holds approximately 80,000 Bitcoin, a massive fortune that is widely believed to be tied to funds stolen during the infamous 2011 hack of the Mt. Gox cryptocurrency exchange. By exploiting the transaction history of this dormant giant, the attackers crafted and broadcasted an explicit message designed to lure anyone monitoring or claiming the address into a trap.
The embedded message links unsuspecting readers to a meticulously crafted, fraudulent website that aggressively impersonates the defunct investment banking firm Salomon Brothers. Once a user visits the fraudulent web portal, they are greeted by a convincing yet entirely fake legal notice.
The fraudulent document claims that the targeted wallet is officially considered "lost or abandoned." To manufacture a sense of urgency and false legitimacy, the site invites supposed rightful owners or claimants to step forward and prove their ownership. Victims are instructed to either sign an on-chain cryptographic message utilizing their private key or submit sensitive personal documentation through an official-looking web contact form. The notice even imposes an arbitrary deadline, warning that if no response is received by October 5, the wallet will be permanently deemed legally abandoned under fictitious legal frameworks.
Security researchers at BitMEX have thoroughly investigated the digital infrastructure behind the campaign and confirmed that the fraudulent website bears no credible connection whatsoever to the real Salomon Brothers or its historic leadership structure. Although the operators of the scam attempted to lend the scheme an aura of authority by publishing a page listing real individuals who previously worked at the historic investment firm during the 1980s, none of these former professionals have any actual association with this spurious, newly minted entity.
Furthermore, analysts noted that the tactical approach used in this campaign bears strong tactical similarities to previous, controversial episodes. Specifically, observers pointed out parallels to past efforts associated with controversial figures such as Calvin Ayre, who previously funded complex legal maneuvers involving the exact same high-profile Bitcoin address.
BitMEX Research explicitly warned the digital asset community about the deceptive nature of the site, stating that the purported links between the fraudulent company and the historic financial institution are entirely fabricated. The research firm noted that while the advisory board page lists genuine financial alumni from decades past, those individuals are completely disconnected from the current malicious operation.
As news of the campaign spread across social media and security channels, cryptocurrency community members quickly weighed in with their own technical assessments. Experienced developers and security analysts pointed out that if a wallet owner truly needed to prove activity or control over an early address, they could simply execute a minor transaction moving a trivial amount of Bitcoin rather than risking their entire balance or inputting sensitive data into an unverified web form.
This practical observation has led many security experts to suspect that the operation is not actually designed to recover lost funds, but rather functions as part of a much broader, highly calculated social engineering scam. The ultimate objective appears to be harvesting sensitive personal information, credentials, or cryptographic signatures under the guise of formal legal compliance.
Security analysts emphasize that interacting with the fraudulent contact form or attempting to verify identity through the linked portal poses severe security risks to anyone managing legacy digital assets. Users have been strongly advised to completely ignore any unexpected on-chain messages or legal warnings attached to dormant addresses through OP_Return outputs.
The emergence of this clever social engineering vector highlights the increasing sophistication and financial motivations driving crypto-related fraud in the modern digital landscape. Attackers are continually evolving their tactics, moving beyond simple phishing emails to leverage immutable blockchain data fields and fake legal documentation to deceive unsuspecting participants.
This ongoing threat landscape is underscored by broader industry statistics tracking digital asset crime. In the first half of the year alone, malicious hackers and cybercriminal syndicates managed to steal over $2.1 billion across 75 separate security incidents. This staggering figure represents a notable 10% increase in total losses compared to the same operational period from the previous year, demonstrating that security vigilance remains more critical than ever for both institutional participants and long-term cryptocurrency holders.
