Analysts at BitMEX Research have raised a serious security alarm regarding a sophisticated new scam campaign targeting early Bitcoin holders, with a particular focus on long-dormant wallets dating back to 2011. The fraudulent scheme attempts to exploit vintage addresses by injecting deceptive transactions and misleading communications directly into the blockchain, leveraging technical features of the network to deceive unsuspecting cryptocurrency veterans and reclaim high-value holdings under false pretenses.
According to the research firm’s findings, the attackers are utilizing OP_Return outputs—an optional field built into Bitcoin transactions that allows users to attach a small amount of arbitrary data to a ledger entry—to broadcast their malicious payloads. By embedding specific data strings into these transaction outputs, the malicious actors can push notifications and false indicators directly to anyone monitoring these historical addresses via block explorers or node software, creating an illusion of official network activity or urgent administrative notices.
In one prominent and well-documented case highlighted by investigators, the scammers trained their sights on the infamous "1Feex" wallet. This particular address holds approximately 80,000 Bitcoins that are widely believed to have been stolen during the historical hack of the Mt. Gox exchange in its early days. Recognizing the immense value tied to the address, the attackers crafted a customized on-chain message designed to lure anyone monitoring or attempting to recover the funds into interacting with an external, fraudulent website that meticulously impersonates the defunct Wall Street investment firm Salomon Brothers.
Upon visiting the fraudulent web portal, potential victims are confronted with an official-looking legal notice. The site asserts that the targeted wallet is legally classified as "lost or abandoned property." To substantiate any legitimate claim of ownership, the notice instructs supposed rightful owners to take action by either signing an on-chain message utilizing the wallet’s private key or submitting sensitive personal documentation and identifying credentials through a dedicated web contact form hosted on the domain. To create a strong sense of urgency, the fake legal notice explicitly warns that if no response or claim is registered by October 5, the wallet will be permanently deemed legally abandoned, forfeit, and transferred to the custody of the fraudulent entity.
Fake legal claims and manufactured authority
As security investigators dug deeper into the infrastructure of the fraudulent campaign, BitMEX Research warned that the website bears no credible connection whatsoever to the real Salomon Brothers or its historic leadership team. While the fraudulent operators attempted to manufacture an aura of legitimacy by publishing a list of real, verifiable individuals who actually worked at the renowned investment firm during the 1980s, none of these former professionals have any association with this new and spurious entity.
The research platform noted that this deceptive approach bears striking tactical similarities to earlier, controversial campaigns. Observers pointed out parallels to efforts previously associated with figures like Calvin Ayre, who had previously funded distinct legal actions involving the very same historical Bitcoin address. However, the current scheme relies entirely on psychological coercion and administrative intimidation rather than formal legal proceedings.
BitMEX Research detailed the deception in their public advisory, stating that the links between the shell company and the website are entirely fabricated. The firm highlighted that while the page features an advisory board containing genuine people from Salomon Brothers’ history, those individuals appear to have no knowledge of or link to the fraudulent enterprise.
Within the broader cryptocurrency community, experienced observers and blockchain analysts have quickly weighed in on the mechanics of the attack. Industry members noted that a legitimate wallet owner wishing to prove activity or control over a dormant address would typically execute a simple, low-risk transaction—such as moving a nominal amount of BTC to a fresh address—rather than handing over sensitive private keys or uploading private identification documents to a web-based form.
This observation has led many security experts to suspect that the campaign is part of a broader social engineering strategy. Rather than attempting a direct technological exploit of the underlying cryptography, the scammers are relying on sophisticated manipulation tactics to gather sensitive information, personal data, or signature authorizations under the guise of regulatory compliance and legal necessity.
BitMEX has strongly emphasized that users, asset recovery specialists, and early holders should completely ignore these on-chain transmissions, avoid interacting with the suspicious contact forms, and under no circumstances disclose private keys or personal details to unverified third-party websites.
The rising tide of cryptocurrency fraud
The sudden emergence of these targeted, on-chain social engineering campaigns underscores the growing complexity and sophistication of modern crypto-related fraud. As blockchain analysis tools become more powerful and public awareness of traditional phishing attempts increases, bad actors are continuously refining their methodologies to exploit the psychology of long-term investors and the nuances of blockchain architecture.
This incident arrives amid a broader landscape of escalating digital asset security threats. Data covering the first half of the year indicates that malicious actors and state-backed hacking syndicates have intensified their operations across the global ecosystem. During the initial six months of the year alone, bad actors successfully stole over $2.1 billion across roughly 75 distinct security incidents, representing a notable 10% increase in total losses compared to the corresponding period in the previous year.
As digital asset values fluctuate and historical fortunes appreciate significantly in fiat terms, dormant addresses controlled by early adopters will likely remain prime targets for opportunistic scammers. Security professionals reiterate that vigilance, skepticism toward unsolicited legal notices, and adherence to fundamental private key security practices remain the most effective defenses against increasingly elaborate blockchain-based threats.
