Security analysts at BitMEX Research have issued an urgent warning to early Bitcoin holders, uncovering a novel and sophisticated scam campaign specifically targeting dormant addresses dating back to 2011. The malicious scheme attempts to exploit long-inactive blockchain accounts by injecting fraudulent transactions and deceptive legal notices directly into the network data, aiming to trick unsuspecting holders into surrendering their private keys or sensitive personal information.
According to the research firm, the attackers are leveraging the OP_Return outputs embedded within the Bitcoin blockchain. OP_Return is an optional field in transactions that allows users to append a small amount of arbitrary data to the ledger. While frequently used for legitimate protocol purposes, timestamps, or commemorative messages, bad actors have repurposed this functionality to broadcast malicious links and misleading claims straight to historical wallets.
The scope and ambition of the campaign became apparent when researchers identified a high-profile target: the famous "1Feex" wallet. This heavily monitored address currently holds approximately 80,000 Bitcoins, which are widely believed to have been compromised during the historic breach of the Mt. Gox cryptocurrency exchange in the early years of the asset’s existence.
In this targeted instance, the perpetrators meticulously crafted a malicious message via the blockchain that directed anyone inspecting the address to a fraudulent website. This rogue domain was engineered to impersonate Salomon Brothers, the legendary and now-defunct Wall Street investment bank, lending a false aura of institutional authority and corporate legitimacy to the cyberattack.
Fake Legal Claims and Improvised Deadlines
Upon visiting the fraudulent replica website, potential victims are confronted with an official-looking legal notice. The platform claims that the targeted dormant wallet is legally classified as "lost or abandoned." To manufacture a false sense of urgency, the notice states that if the supposed rightful owners do not step forward to claim the funds by an impending deadline of October 5, the wallet will officially be deemed abandoned under fictitious legal statutes.
The fake platform outlines procedures for individuals to prove ownership of the address. It invites purported owners either to sign an on-chain cryptographic message using their private key—a critical security credential that would give malicious actors immediate, unmitigated access to the funds—or to submit comprehensive personal documentation through an unverified web contact form.
However, a closer examination by BitMEX Research revealed glaring discrepancies that expose the entire operation as a fraudulent setup. The research firm noted that the website shares no genuine, verifiable connection to the real Salomon Brothers or its historic leadership structure. While the scammers attempted to build credibility by publishing a list of real individuals who were legitimately employed by the investment bank during the 1980s, none of these former professionals have any actual association with the spurious entity behind the new scheme.
Furthermore, analysts noted striking parallels between this campaign and earlier, controversial maneuvers surrounding the same Bitcoin address. The approach echoes previous strategies associated with public figures such as Calvin Ayre, who previously financed legal actions centered on the exact same Bitcoin ledger entry.
BitMEX Research detailed these findings, stating that the associations manufactured by the website are entirely fictitious. The advisory board page featuring real-life veterans of Salomon Brothers serves merely as window dressing to deceive victims, as these individuals have no link whatsoever to the fraudulent entity orchestrating the current campaign.
Broader Implications and Social Engineering Tactics
As news of the campaign spread across digital asset forums, community members and blockchain sleuths quickly weighed in on the mechanics of the attack. Industry participants pointed out that a legitimate wallet owner wishing to demonstrate ongoing control over an asset would simply need to broadcast a standard, minor transaction moving a negligible amount of Bitcoin to prove activity. There is no valid legal or technical requirement to interact with obscure web forms or sign arbitrary messages on untrusted third-party platforms.
These observations have led security experts to conclude that the entire campaign is a calculated social engineering effort. Rather than attempting a direct cryptographic exploit of the Bitcoin protocol, the perpetrators are relying on psychological manipulation, manufactured legal intimidation, and administrative confusion to harvest sensitive information or private keys from aging or inattentive holders.
BitMEX has strongly reiterated its advisory, emphasizing that users must avoid interacting with the malicious contact form, refrain from submitting personal information, and under no circumstances sign messages or disclose private keys based on unverified blockchain prompts.
The emergence of this sophisticated wallet-recovery scam underscores the growing complexity and ingenuity of cryptocurrency-related fraud. Financial criminals continue to adapt their methodologies to target high-net-worth holders and historical addresses, leveraging on-chain data fields to deliver their attacks straight to the blockchain.
This localized threat arrives against a backdrop of escalating digital asset crime globally. Data from security monitors indicates that in the first half of the year alone, hackers and cyber syndicates successfully stole over $2.1 billion across 75 separate security incidents. This figure represents a notable 10% increase in stolen funds compared to the corresponding period in the previous year, highlighting the persistent challenges facing security infrastructure as the digital asset ecosystem continues to mature.
