Analysts at BitMEX Research have raised a critical security alarm regarding a sophisticated new scam campaign targeting early Bitcoin holders, specifically focusing on long-dormant cryptocurrency wallets dating back to 2011. The fraudulent scheme appears to exploit historic blockchain addresses by injecting deceptive data and engineered transactions directly onto the ledger, weaponizing the network’s own infrastructure to orchestrate a social engineering attack under the guise of official legal compliance.
According to findings shared by the research firm, the perpetrators are capitalizing on the immutable nature of the blockchain by embedding false transactions and misleading messages via OP_Return outputs. The OP_Return field is a standard, optional feature within Bitcoin transactions designed to allow developers and users to carry arbitrary data on-chain. While normally utilized for protocol metadata, proofs of existence, or custom tokens, bad actors have repurposed this mechanism to broadcast deceptive text directly to anyone monitoring early blockchain addresses.
In one prominent and well-documented case highlighted by investigators, the attackers specifically targeted the infamous "1Feex" wallet. This address holds approximately 80,000 Bitcoin and is widely tracked by the broader cryptocurrency community due to its connection to funds believed to have been stolen during the catastrophic 2011 hack of the early exchange Mt. Gox. The malicious actors crafted a targeted on-chain message linked to this specific address, directing observers and potential victims toward a carefully constructed fraudulent website designed to impersonate the historic, defunct Wall Street financial institution Salomon Brothers.
The fake web portal presents visitors with an authoritative-looking legal notice claiming that the targeted wallet is officially classified as "lost or abandoned." To manufacture a sense of false legitimacy and urgency, the site invites supposed rightful owners or claimants to step forward and prove their ownership. Victims are prompted to complete this process either by cryptographically signing an on-chain message using the private key associated with the ancient wallet or by submitting comprehensive personal documentation through an embedded web contact form. Furthermore, the fraudulent notice attempts to manufacture a high-stakes timeline, stating that if no formal response or claim is registered by October 5, the wallet will be legally deemed abandoned and permanently forfeited.
Fake Legal Claims and Deceptive Advisory Boards
Following the emergence of the campaign, BitMEX Research conducted a deeper investigation into the infrastructure and claims behind the fraudulent Salomon Brothers impersonation site. The firm warned that the website bears zero credible, legitimate link to the historical Salomon Brothers investment bank or its former executive leadership. Investigators discovered that while the perpetrators attempted to manufacture credibility by publishing a list of real, historical individuals who actually worked at the firm during the 1980s, none of those former professionals have any affiliation whatsoever with this new and spurious entity.
The research platform noted that the overall structure and approach of the operation bear strong resemblances to earlier, controversial controversies. Specifically, analysts pointed out tactical parallels to past campaigns associated with figures like Calvin Ayre, who previously funded complex legal maneuvers involving the exact same historic Bitcoin address. However, this iteration leans heavily into digital deception and institutional impersonation to trick unsuspecting individuals or their estates.
"The links between this company and this website are fake," BitMEX Research stated in its public advisory. "There is a page with an ‘advisory board’ that contains real people who worked at Salomon Brothers in the 1980s, however, these people seem to have no link to this new spurious entity."
Members of the wider cryptocurrency community have also weighed in on the mechanics of the scam, pointing out glaring technical inconsistencies that expose the operation’s fraudulent nature. Commentators noted that any legitimate wallet owner seeking to prove ongoing activity or control over a dormant address would simply need to broadcast a routine, self-directed transaction moving a negligible amount of Bitcoin to establish activity, rather than uploading sensitive personal identification documents or interacting with unverified external legal entities.
This glaring discrepancy has led security experts and community sleuths to suspect that the campaign is not a genuine legal reclamation effort, but rather a calculated social engineering scam designed exclusively to harvest sensitive personal information, cryptographic credentials, or legal declarations under a false regulatory pretext. In light of these risks, BitMEX has strongly emphasized that users, holders, and asset managers should under no circumstances interact with the contact form, provide personal documentation, or attempt to engage with the fraudulent web portal.
The sudden rise of these targeted blockchain-based campaigns underscores the rapidly evolving and increasingly complex landscape of cryptocurrency-related fraud. As decentralized assets mature and early holdings appreciate significantly in value, malicious actors continuously adapt their tactics, blending traditional social engineering schemes with on-chain data manipulation. This sophisticated threat environment unfolds against a backdrop of escalating financial losses across the broader digital asset ecosystem. Industry tracking data indicates that in the first half of the year alone, hackers and cybercriminal syndicates successfully stole over $2.1 billion across 75 separate security incidents, marking a notable 10% rise in total stolen funds compared to the same period in the previous year.
