Analysts at BitMEX Research have raised a critical security alarm regarding a sophisticated new scam campaign targeting early Bitcoin holders, with a particular focus on dormant wallets dating back to 2011.
According to the research firm, the malicious campaign exploits long-inactive blockchain addresses by injecting false transactions and misleading, coercive messages directly into the ledger. Attackers are utilizing OP_Return outputs—an optional field within Bitcoin transactions capable of carrying arbitrary data—to deliver their fraudulent payloads straight to the on-chain history of unsuspecting or long-absent cryptocurrency investors.
In one prominent and well-documented case uncovered by analysts, the scammers set their sights on the famous "1Feex" wallet. This heavily monitored address holds approximately 80,000 Bitcoin, a massive fortune widely believed to have been tied to funds stolen during the historic security breach of the Mt. Gox exchange years ago. To target this and potentially other high-value dormant addresses, the attackers meticulously crafted an on-chain message designed to direct recipients toward a fraudulent, highly deceptive website impersonating the defunct Wall Street investment firm Salomon Brothers.
Fake Legal Claims and Impersonation Tactics
The fraudulent website engineered by the scammers presents visitors with a chilling and entirely fabricated legal notice. The text claims that the targeted wallet is legally classified as "lost or abandoned," creating an immediate sense of urgency and panic for anyone who might legitimately believe they have a claim to the funds or who is monitoring the address.
The fake notice then invites supposed owners to step forward and prove their ownership claims. To do so, the site instructs victims to either sign an on-chain message using their private key or submit sensitive personal documentation through an online web contact form. Adding to the psychological pressure, the fraudulent notice imposes a strict deadline, stating that if no formal response or claim is received by October 5, the wallet will be officially and permanently deemed legally abandoned under fictitious legal frameworks.
BitMEX Research thoroughly investigated the claims made on the fraudulent platform and warned the public that the website shows no credible, verifiable link to the real Salomon Brothers or its former corporate leadership. While the site attempts to manufacture legitimacy by displaying a list of real individuals who historically worked at the investment firm during the 1980s, security analysts confirmed that none of these former professionals appear to have any association whatsoever with this new and spurious entity.
Furthermore, industry observers and cryptocurrency community members have pointed out striking similarities between this current campaign and earlier, controversial legal maneuvers. Analysts noted that the approach is heavily reminiscent of past efforts associated with controversial figures such as Calvin Ayre, who previously funded separate legal actions and public campaigns involving the exact same Bitcoin address.
Community Warnings and Social Engineering Risks
As news of the scam spread across social media and developer forums, cryptocurrency community members quickly weighed in to debunk the technical and legal logic presented by the attackers. Security-conscious observers noted that a legitimate wallet owner wishing to prove activity or ownership on the blockchain would simply need to move a small, negligible amount of Bitcoin to establish control, rather than transferring a full balance or exposing private keys and personal identity documents to an unverified third-party website.
This glaring discrepancy has led many security researchers and blockchain analysts to suspect that the entire campaign is not a genuine legal dispute, but rather part of a broader, highly targeted social engineering scam. The ultimate objective appears to be gathering sensitive personal information, private keys, or credentials under the false and intimidating pretext of a formal legal proceeding.
In their advisory, BitMEX Research strongly emphasized that cryptocurrency holders and community members should under no circumstances interact with the fraudulent contact form, attempt to sign messages for the site, or provide any personal details whatsoever.
The Rising Threat of Crypto-Related Fraud
The emergence of these inventive, on-chain social engineering tactics highlights the growing complexity and ingenuity of modern crypto-related fraud. As blockchain analysis tools become more advanced, malicious actors are increasingly turning to psychological manipulation, sophisticated impersonation, and protocol-level features like OP_Return messages to deceive targets.
This incident arrives against a backdrop of mounting security challenges across the digital asset ecosystem. In the first half of 2025 alone, hackers and malicious actors successfully stole over $2.1 billion across 75 separate security incidents. This staggering figure represents a concerning 10% rise in total stolen funds compared to the same period in 2024, underscoring the urgent need for heightened vigilance among both retail investors and institutional holders of legacy cryptocurrency assets.
