Analysts at BitMEX Research have raised a critical security alarm regarding a sophisticated new scam campaign targeting early Bitcoin holders, with a particular focus on dormant wallets dating back to the foundational era of cryptocurrency in 2011.
According to the blockchain intelligence and research firm, the malicious campaign exploits long-inactive cryptocurrency addresses by injecting fraudulent transactions and highly misleading messages directly into the blockchain using OP_Return outputs. This optional field in Bitcoin transactions allows users to carry arbitrary data within a transaction, a technical feature that scammers are increasingly misusing to broadcast malicious links and social engineering pretexts to unsuspecting holders or historical network observers.
In one of the most prominent documented cases of this ongoing campaign, the attackers focused their efforts on the well-known "1Feex" wallet. This historically significant address currently holds approximately 80,000 Bitcoin, a massive fortune that is widely believed by blockchain forensics experts to have been stolen during the infamous 2011 security breach of the early cryptocurrency exchange Mt. Gox.
Rather than attempting a direct technological exploit of the private keys—which remains mathematically infeasible—the attackers instead crafted a custom transaction containing an OP_Return message. This message directs anyone monitoring or investigating the address to a fraudulent website meticulously designed to impersonate the defunct Wall Street investment firm Salomon Brothers.
Upon visiting the fraudulent web portal, potential targets are confronted with a fabricated legal notice. The site claims that the high-value dormant wallet in question is legally classified as "lost or abandoned." It then issues a pressing call to action, inviting supposed owners or rightful heirs to step forward and prove their rightful claim to the digital assets.
To complete this purported verification process, the site instructs victims to either sign an on-chain message using their private keys or submit sensitive personal documentation through an embedded web contact form. To create a false sense of urgency and panic, the legal notice warns that if no legitimate owner comes forward or responds to the demand by October 5, the wallet will officially and permanently be deemed legally abandoned under fictitious statutory guidelines.
Fake Legal Claims and Fabricated Advisory Boards
Following the initial discovery of the campaign, BitMEX Research conducted a deeper investigation into the infrastructure and claims behind the fraudulent Salomon Brothers impersonation site. The research firm quickly determined that the website bears no credible connection whatsoever to the real, historical Salomon Brothers or its former corporate leadership.
While the fraudulent platform attempts to manufacture an air of corporate legitimacy by displaying a list of real individuals who genuinely worked at the prominent investment bank during the 1980s, investigators confirmed that none of these former professionals have any association with this new and spurious corporate entity.
Security analysts noted that this manipulative approach bears striking similarities to earlier, controversial controversies. Observers pointed out that the operational style is reminiscent of past campaigns associated with controversial figures such as Calvin Ayre, who previously funded complex legal maneuvers involving the exact same high-profile Bitcoin address.
In a public statement detailing the threat, BitMEX Research emphasized the deceptive nature of the setup, noting that the web presence relies entirely on borrowed credentials and fabricated associations.
"The links between this company and this website are fake," BitMEX Research stated in their public warning. "There is a page with an ‘advisory board’ that contains real people who worked at Salomon Brothers in the 1980s, however, these people seem to have no link to this new spurious entity."
As news of the campaign circulated across digital asset communities, experienced cryptocurrency users and blockchain security analysts quickly weighed in on the mechanics of the trap. Community members pointed out a glaring logical inconsistency in the scammers’ demands, noting that a legitimate wallet owner wishing to prove active control over an ancient address would simply need to move a negligible amount of Bitcoin to a new address. This standard cryptographic procedure would definitively prove activity and control without requiring the user to risk transferring their full balance or exposing private keys to untrusted web interfaces.
The realization that the scam relies on psychological pressure rather than technical necessity has led many security experts to conclude that the campaign is part of a much broader, highly calculated social engineering effort. Rather than aiming for immediate automated theft, these attacks are increasingly designed to harvest sensitive personal information, identity documents, or credential data under a convincing legal pretext, which can later be used for more targeted extortion or coordinated account takeovers.
In light of these findings, BitMEX Research issued a definitive advisory urging all cryptocurrency holders, particularly those managing legacy assets or dormant accounts, to completely ignore these on-chain messages. Users have been strongly cautioned never to interact with the malicious contact forms, never to input private keys into unverified web applications, and never to submit personal identification documents in response to unsolicited blockchain notices.
A Growing Wave of Crypto Fraud
The emergence of these specialized social engineering tactics highlights the expanding complexity and ingenuity of modern cryptocurrency-related fraud. As blockchain analytics firms and law enforcement agencies improve their ability to track traditional hacks and smart contract exploits, malicious actors are increasingly turning to psychological manipulation and sophisticated impersonation schemes to target high-net-worth individuals and long-term crypto investors.
This evolving threat landscape unfolds against the backdrop of staggering financial losses across the global digital asset ecosystem. According to industry tracking data, the first half of the year saw hackers and bad actors steal over $2.1 billion across 75 separate security incidents. This represents a concerning 10% increase in total stolen funds compared to the same tracking period from the previous year, underscoring the urgent need for heightened vigilance, robust operational security, and rigorous verification standards across the entire cryptocurrency community.
