According to the research firm, the malicious campaign exploits old, inactive blockchain addresses by injecting deceptive transactions and misleading messages directly into the ledger. Attackers are utilizing OP_Return outputs—an optional field built into Bitcoin transactions that allows users to append a small amount of arbitrary data to the blockchain—to broadcast their fraudulent narratives directly to anyone monitoring the blockchain history of these ancient addresses.
The alarming scheme came to light after attackers specifically targeted the infamous "1Feex" wallet, a heavily monitored address holding approximately 80,000 Bitcoin that is widely believed to be tied to funds stolen during the historic Mt. Gox exchange hack of 2011. In this targeted attack, the fraudsters engineered an on-chain message containing a link directing visitors to a fraudulent website meticulously designed to impersonate Salomon Brothers, the prominent Wall Street financial services firm that ceased operations in its original form decades ago.
Upon visiting the counterfeit website, targeted individuals are met with a fabricated legal notice asserting that the associated wallet is legally classified as "lost or abandoned." The site then presents a stern directive, urging the supposed rightful owners to step forward and prove their claim. Victims are instructed to either sign an on-chain cryptographic message utilizing their private keys or submit sensitive personal documentation through an official-looking web contact form hosted on the portal. To induce panic and force rushed decisions, the fraudulent notice imposes a strict deadline of Oct. 5, threatening that failure to respond by the specified date will result in the wallet being formally declared legally abandoned and forfeited.
Fake legal claims
BitMEX Research swiftly debunked the legitimacy of the campaign, emphasizing that the fraudulent website bears no genuine connection to the real Salomon Brothers or its legacy leadership. A deeper inspection of the deceptive web portal revealed a dedicated advisory board page featuring the names and biographical details of real individuals who genuinely worked at Salomon Brothers during the 1980s. However, the research firm confirmed that these former Wall Street executives have absolutely no affiliation with this newly emerged, spurious corporate entity attempting to reclaim the ancient digital assets.
Industry observers have noted unsettling similarities between this current campaign and earlier, highly controversial legal maneuvers involving the exact same Bitcoin address. Past legal and media campaigns surrounding the "1Feex" wallet have frequently attracted public attention due to the involvement of polarizing figures, such as Calvin Ayre, who previously financed aggressive legal initiatives aimed at staking a claim to the historic Mt. Gox funds.
Commenting on the deceptive tactics deployed in the latest campaign, BitMEX Research outlined the disconnect between the fake entity and its purported pedigree, stating that the links between the company and the website are entirely fabricated. The firm highlighted the use of real historical figures on the advisory board page as a calculated social engineering tactic designed to trick unsuspecting holders into lowering their guard.
Cryptocurrency community members have also weighed in heavily on the situation across various public forums and social media networks. Seasoned blockchain users pointed out the glaring technical flaws in the scammers’ premise, noting that legitimate wallet owners wishing to prove active control over a dormant address would merely need to move a negligible amount of Bitcoin to a new address, rather than exposing their entire balance or handing over sensitive private data.
These observations have led security researchers and community analysts to conclude that the campaign functions primarily as a sophisticated social engineering effort. Rather than attempting a direct cryptographic hack, the fraudsters are relying on psychological pressure, leveraging official-looking legal jargon and fabricated deadlines to trick elderly or absentee holders into surrendering sensitive personal information or signing malicious transactions that could compromise their entire digital wealth.
BitMEX Research has strongly advised all cryptocurrency holders to exercise extreme caution, warning users never to interact with the suspicious contact forms, download external links, or provide personal identification and cryptographic keys under any circumstances.
The emergence of this elaborate lost-wallet scheme highlights the ever-increasing sophistication and complexity of modern cryptocurrency fraud. Malicious actors continue to pioneer novel attack vectors that blend blockchain technology with classic social engineering, preying on the historical opacity and permanence of the digital asset ecosystem. This incident unfolds against a wider backdrop of escalating financial crime within the sector. According to recent industry data, crypto hackers and cybercriminal syndicates successfully stole over $2.1 billion across 75 distinct security incidents during the first half of 2025 alone, representing a concerning 10% increase in total losses compared to the same period in the previous year. As digital asset values remain high and historical wallets sit dormant, security experts urge the community to remain intensely vigilant against deceptive notices and unsolicited legal claims targeting early blockchain holdings.
