Security analysts at BitMEX Research have issued an urgent warning to the cryptocurrency community regarding a sophisticated new scam campaign targeting early Bitcoin holders, particularly those with dormant wallets dating back to 2011. The fraudulent scheme attempts to trick owners of long-inactive addresses by injecting false transactions and misleading messages directly onto the blockchain, leveraging official-looking legal pretexts to compromise digital assets or extract sensitive personal data.
According to the findings shared by BitMEX Research, the attackers exploit an optional field in Bitcoin transactions known as OP_Return outputs. This mechanism allows users to attach a small amount of arbitrary data to a transaction. In this campaign, malicious actors have used the feature to embed deceptive messages and transaction links into long-dormant addresses, attempting to trick any monitors or holders checking the blockchain history of these vintage accounts.
The scale and ambition of the campaign became apparent when researchers identified a high-profile target: the notorious "1Feex" wallet. This well-known address currently holds approximately 80,000 Bitcoin that are widely believed to have been stolen during the massive security breach of the Mt. Gox exchange in its early years of operation. The attackers crafted an intricate digital trap tailored specifically to this history, deploying an on-chain message designed to direct anyone monitoring the address toward a fraudulent external website.
Fake Legal Claims and Coordinated Imposture
The fraudulent website uncovered by BitMEX Research is designed to impersonate the defunct investment banking firm Salomon Brothers. Upon visiting the site, potential victims are greeted with a formal-looking legal notice claiming that the targeted wallet is legally classified as "lost or abandoned."
To heighten the psychological pressure and create a false sense of urgency, the notice outlines a strict procedure for recovery. It invites supposed rightful owners to prove their claims by signing an on-chain cryptographic message using their private key or by submitting detailed personal documentation through an embedded web contact form. The fraudulent notice even introduces an arbitrary deadline, warning that if no valid response or claim is received by October 5, the wallet will be officially deemed abandoned under fictitious legal frameworks.
However, a closer inspection of the infrastructure and claims behind the website reveals a stark lack of legitimacy. BitMEX Research confirmed that the fraudulent platform bears no credible connection to the real Salomon Brothers or its historical leadership structure. While the scam website attempts to manufacture artificial credibility by displaying a list of real individuals who genuinely worked at the investment bank during the 1980s, none of those former employees have any known association with the new and spurious entity running the campaign.
The research platform noted that the methodology and overarching presentation bear strong similarities to previous controversial attempts to claim the exact same Bitcoin address. Analysts pointed out that the tactic resembles earlier campaigns funded by figures such as Calvin Ayre, who previously backed legal maneuvers involving the 1Feex address, though this new iteration appears to operate purely as an online phishing and social engineering trap rather than a legitimate court proceeding.
"The links between this company and this website are fake," BitMEX Research stated in their public warning. "There is a page with an ‘advisory board’ that contains real people who worked at Salomon Brothers in the 1980s, however, these people seem to have no link to this new spurious entity."
Community Reactions and Broader Security Concerns
The disclosure quickly drew widespread attention and discussion across the broader cryptocurrency community. Experienced blockchain users and security analysts weighed in on the mechanics of the scheme, pointing out glaring operational flaws in the scammers’ premise. Industry commentators noted that legitimate wallet owners wishing to prove active control over a dormant address would typically perform a minor, self-directed transaction—such as moving a nominal amount of Bitcoin to a new address—rather than interacting with an unverified third-party legal portal or exposing their private keys.
These observations have led security experts to conclude that the campaign is not a genuine legal dispute, but rather a calculated social engineering scam. The primary objective appears to be harvesting sensitive personal information, convincing victims to surrender private keys, or luring unsuspecting individuals into a trap where they can be manipulated under the guise of legal compliance.
Security professionals have reiterated strong warnings advising users and asset holders never to interact with the contact forms, links, or instructions hosted on unverified third-party websites claiming jurisdiction over historical blockchain addresses. Even for wallets that have remained untouched for over a decade, blockchain security relies strictly on cryptographic key management rather than external web portals or administrative declarations.
The emergence of this targeted campaign highlights the growing sophistication and persistence of threat actors within the digital asset ecosystem. Fraudsters continue to invent elaborate pretexts—ranging from fake regulatory compliance notices and recovery services to sophisticated impersonations of historical financial institutions—to exploit the psychological vulnerabilities of long-term holders.
This incident also arrives against the backdrop of an increasingly challenging security landscape for the broader cryptocurrency industry. Financial losses stemming from hacks, exploits, and digital scams continue to mount at an alarming pace. Industry data indicates that in the first half of 2025 alone, malicious actors and state-backed hacking groups stole over $2.1 billion across roughly 75 distinct security incidents, representing a notable rise compared to figures recorded during the corresponding period in the previous year.
As digital asset security firms and blockchain investigators continue to monitor these emerging threats, experts emphasize that vigilance and adherence to fundamental cryptographic hygiene remain the primary defenses against increasingly elaborate social engineering campaigns. Holders of legacy assets are urged to treat any unsolicited legal notifications or unexpected blockchain messages with extreme skepticism.
