Analysts at BitMEX Research have raised the alarm regarding a sophisticated new scam campaign targeting early Bitcoin holders, with a particular focus on long-dormant addresses dating back to 2011. The fraudulent scheme appears to exploit these vintage addresses by injecting false transactions and misleading messages directly into the blockchain, utilizing the OP_Return output field—an optional space in Bitcoin transactions designed to carry arbitrary data.
According to the firm’s findings, the perpetrators behind the campaign have targeted prominent historical wallets, including the heavily scrutinized "1Feex" address. This specific wallet currently holds approximately 80,000 Bitcoin, a massive balance widely believed to have originated from the historic Mt. Gox exchange hack. In this particular instance, the attackers embedded a customized message within an on-chain transaction, directing anyone monitoring the wallet to a fraudulent website meticulously designed to impersonate the defunct investment bank Salomon Brothers.
The counterfeit website presents visitors with a formal-looking legal notice, baselessly claiming that the targeted wallet is legally classified as "lost or abandoned." To create a facade of legitimacy, the platform instructs supposed owners to verify their claims by executing an on-chain message signature using their private keys or by submitting sensitive personal and financial documentation through an online contact form. The notice even imposes an urgent deadline, warning that if no valid claim or response is received by October 5, the wallet will officially be treated as legally forfeited.
Fake legal claims
BitMEX Research thoroughly debunked the claims made on the fraudulent website, noting that the platform exhibits no credible connection to the real Salomon Brothers or its historic leadership structure. While the site attempts to manufacture credibility by displaying a list of legitimate individuals who genuinely worked at the investment firm during the 1980s, an investigation shows that none of these former professionals maintain any association with this newly emerged and spurious entity.
Industry analysts have drawn parallels between this current scheme and prior controversies surrounding the "1Feex" address. Specifically, the approach bears a striking resemblance to earlier legal maneuvering associated with controversial figures such as Calvin Ayre, who previously financed litigation involving the exact same Bitcoin address. However, security experts emphasize that this new digital facade is built entirely around deception rather than legitimate legal recourse.
Within the broader cryptocurrency community, experienced observers have quickly weighed in on the mechanics of the scam. Many have pointed out a glaring operational flaw in the attackers’ narrative: a legitimate owner of an old wallet wishing to prove activity or ownership does not need to interact with a strange legal portal or risk exposing private keys. Instead, a genuine holder could simply transfer a nominal amount of Bitcoin from the address to demonstrate active control over the private keys, rendering the elaborate legal web portal entirely unnecessary.
This glaring discrepancy has led security researchers and community members alike to suspect that the campaign is merely a component of a much broader social engineering effort. Rather than possessing any legitimate legal standing, the scheme appears engineered to harvest sensitive user information, private keys, and personal credentials under the guise of regulatory and legal compliance.
Security analysts at BitMEX have issued a stern warning to the digital asset community, strongly advising all users to avoid interacting with the fraudulent contact forms, visiting the spoofed domains, or providing any personal details or cryptographic signatures.
The emergence of these inventive social engineering vectors underscores the steadily growing complexity and sophistication of modern cryptocurrency-related fraud. The broader digital asset landscape continues to face escalating security threats, with malicious actors constantly refining their tactics to prey on unsuspecting participants. According to recent industry data, crypto-related thefts and heists surpassed $2.1 billion across 75 distinct security incidents during the first half of 2025 alone, marking a concerning 10% increase compared to the figures recorded during the corresponding period in the previous year. As these fraudulent operations become increasingly elaborate, security experts maintain that vigilance and independent verification remain the first and best line of defense for long-term cryptocurrency holders.
