Analysts at BitMEX Research have raised a critical security alarm regarding an emerging cryptocurrency scam specifically targeting early Bitcoin holders, with a primary focus on legacy wallets dating back to 2011. The sophisticated campaign exploits long-dormant blockchain addresses by injecting deceptive transactions and misleading messages directly onto the ledger, weaponizing the network’s technical features to orchestrate social engineering attacks against unsuspecting cryptocurrency pioneers.
According to findings shared by the research firm, the perpetrators leverage OP_Return outputs—an optional field built into Bitcoin transactions designed to carry small amounts of arbitrary data—to broadcast false claims to historical wallet addresses. In one prominent and well-documented case highlighted by analysts, the attackers trained their sights on the heavily scrutinized "1Feex" wallet. This infamous address currently holds approximately 80,000 Bitcoin, a massive fortune widely believed to have originated from the historic security breach of the defunct Tokyo-based exchange Mt. Gox.
Within this specific attack vector, the malicious actors embedded a crafted message that directs unsuspecting individuals to a fraudulent website. This fraudulent web portal brazenly impersonates the legacy financial firm Salomon Brothers, attempting to project an aura of established corporate and legal authority to lower the guard of targeted asset holders.
Fake Legal Claims and Fabricated Abandonment Notices
Upon visiting the fraudulent website, targets are met with a fabricated legal notice alleging that their long-dormant Bitcoin wallet has officially been classified as "lost or abandoned." The site demands that supposed rightful owners come forward to verify their claims. To allegedly authenticate ownership, the portal instructs victims to perform high-risk actions, such as signing an on-chain cryptographic message using their private key or submitting sensitive personal documentation through a rudimentary web-based contact form.
To pressure victims into swift action, the fake legal notice introduces an artificial deadline, warning that if no ownership claim is properly registered and received by October 5, the targeted wallet will permanently forfeit its legal status and be absorbed under the parameters outlined by the spurious entity.
However, a closer inspection of the infrastructure by security researchers exposed the entirely fraudulent nature of the operation. BitMEX Research explicitly warned the public that the website bears no credible connection, legal association, or operational link to the real Salomon Brothers or any of its historical leadership teams. While the scammers attempted to build a facade of legitimacy by publishing a list of real individuals who genuinely worked at Salomon Brothers during the 1980s, security analysts confirmed that none of these former professionals have any affiliation whatsoever with the newly minted, suspicious entity orchestrating the campaign.
Investigators noted that the operational blueprint and underlying strategy closely mirror earlier, controversial scams. Previous iterations of similar tactics have been linked by researchers to public figures such as Calvin Ayre, who previously funded distinct legal actions centered around the exact same historical Bitcoin address.
In a public statement detailing the mechanics of the scheme, BitMEX Research emphasized the deceptive nature of the web portal’s advisory board page, stating that the connections between the company and the website are entirely fabricated. While acknowledging the presence of real former Salomon Brothers employees listed on the platform, the firm reiterated that these individuals appear to have zero relationship with the spurious organization behind the notices.
Community Warning and the Broader Threat Landscape
The cryptocurrency community has quickly mobilized in response to the alerts, with veteran holders and developers weighing in on the technical absurdities presented by the scam. Industry participants pointed out that legitimate wallet owners wishing to prove active control over a dormant address would never need to interact with a third-party legal portal or surrender private keys; instead, simply moving a negligible amount of Bitcoin from the address to a fresh location would unequivocally demonstrate active ownership and ongoing control without risking the entire balance.
This glaring technical mismatch has led security experts and community members alike to conclude that the campaign is merely a component of a much wider, aggressive social engineering initiative. The primary objective of these fraudsters is not direct blockchain theft through technical exploits, but rather the systematic harvesting of sensitive personal data, cryptographic credentials, and private keys under the convincing guise of official legal proceedings.
Security analysts have issued clear directives urging cryptocurrency users, particularly early adopters who managed to secure coins during the network’s infancy, to exercise extreme caution. Individuals have been strongly advised to completely ignore these on-chain messages, avoid visiting the fraudulent websites, and under no circumstances interact with contact forms or disclose personal information and private keys.
The emergence of these specialized, highly targeted social engineering schemes highlights the rapidly escalating complexity and sophistication of modern cryptocurrency-related fraud. As malicious actors continue to refine their methodologies to deceive even seasoned participants, the financial stakes across the digital asset ecosystem continue to mount. According to broader industry data tracking digital asset crime, hackers and scammers successfully stole over $2.1 billion across 75 separate security incidents during the first half of 2025 alone, representing a notable 10% increase in total losses compared to the exact same period in the previous year.
