Analysts at BitMEX Research have raised a serious security alarm regarding a sophisticated new scam campaign targeting early Bitcoin holders, with a specific focus on wallets dating back to the pioneering era of 2011. The fraudulent operation appears to systematically exploit long-dormant cryptocurrency addresses by injecting deceptive transactions and misleading messages directly into the blockchain, leveraging technical features of the network to deceive unwary recipients.
According to the research firm, the attackers utilize OP_Return outputs—an optional field built into Bitcoin transactions that allows users to append a small amount of arbitrary data to a transfer—to plant false indicators and direct attention toward specific targets. In one prominent and well-documented case highlighted by the security analysts, the perpetrators targeted the famous “1Feex” wallet. This heavily monitored address currently holds approximately 80,000 Bitcoin, a massive fortune widely believed to have been tied to the historic hacks of the defunct Mt. Gox exchange.
Rather than attempting a direct technological compromise of the private keys, the orchestrators of the scheme crafted an elaborate social engineering narrative. The on-chain data links potential victims to a fraudulent website meticulously designed to impersonate the legendary and long-defunct Wall Street financial institution, Salomon Brothers.
Upon visiting the fraudulent portal, targeted wallet holders are met with a fabricated legal notice asserting that their dormant cryptocurrency holding has been officially categorized as "lost or abandoned." The site then presents a demand for the supposed owners to step forward and prove their rightful claim to the digital assets. To accomplish this, the fraudulent platform instructs users to either sign an on-chain message using their private keys or submit sensitive personal documentation through an online contact form provided on the web page. Adding a manufactured sense of urgency and pressure, the notice explicitly warns that if no ownership claim or response is registered by October 5, the wallet will face legal forfeiture and be permanently deemed abandoned under fictitious legal frameworks.
Fake Legal Claims and Exploited Identities
Following the initial discovery, BitMEX Research conducted a deeper investigation into the fraudulent entity and quickly uncovered glaring inconsistencies confirming the deceptive nature of the campaign. The analysts warned that the website exhibits zero credible links, legal connections, or historical association with the real Salomon Brothers or its former leadership executives.
While the bad actors attempted to build a facade of legitimacy by publishing a list of real individuals who genuinely worked at the prestigious financial firm during the 1980s, none of those former employees have any known or actual connection to this newly minted and spurious online entity.
The investigative platform noted that this tactical approach bears a striking resemblance to previous controversies. Specifically, the campaign echoes earlier maneuvering associated with figures such as Calvin Ayre, who previously financed and directed legal actions involving the exact same controversial Bitcoin address. However, this modern variant twists those historical disputes into a web-based credential-harvesting trap.
Highlighting the deep disconnect between the website’s claims and reality, BitMEX Research stated that the links between the shell company and the presented website are entirely fabricated. The firm pointed out the presence of an advisory board page containing real professionals from the 1980s era of Salomon Brothers, yet verified that these individuals seem to have no relationship whatsoever with the spurious entity running the current campaign.
Community Warnings and Broader Crypto Fraud Trends
As news of the campaign spread across security circles and social media platforms, cryptocurrency community members quickly weighed in to debunk the narrative and offer guidance. Observers pointed out a glaring operational security flaw in the scammers’ logic: a legitimate wallet owner wishing to prove activity and dismiss claims of abandonment would simply need to move a negligible amount of Bitcoin to a new address. There would be no requirement to interact with a third-party legal portal or surrender sensitive private keys and personal identification data.
This technical reality has led security experts and community analysts to conclude that the campaign is part of a much broader, highly calculated social engineering effort. The ultimate objective appears to be gathering sensitive private keys, seed phrases, or personal identifiable information under the guise of an official legal pretext, setting the stage for devastating asset thefts.
Security analysts emphasize that users should exercise extreme caution, completely ignore the fraudulent contact forms, and avoid interacting with any on-chain messages or associated links tied to the campaign.
The emergence of these specialized scams underscores the rapidly evolving and increasingly complex nature of cryptocurrency-related fraud. Threat actors continue to devise innovative psychological and technical vectors to target high-value assets. Financial crime statistics illustrate the scale of the ongoing threat landscape, showing that in the first half of 2025 alone, hackers and malicious actors successfully stole over $2.1 billion across 75 distinct security incidents, marking a substantial 10% increase in stolen capital compared to the corresponding period in the previous year.
