Analysts at BitMEX Research have raised a critical security alarm regarding a sophisticated new scam campaign targeting early Bitcoin holders, with a particular focus on dormant wallets dating back to the foundational years of the cryptocurrency, including 2011. The fraudulent scheme exploits long-inactive blockchain addresses by injecting deceptive transactions and misleading messages directly into the ledger, utilizing optional data fields to ensnare unsuspecting cryptocurrency pioneers.
According to the research firm, the attackers are leveraging OP_Return outputs—an optional field built into Bitcoin transactions capable of carrying arbitrary data—to broadcast false alerts to old wallet addresses. In one prominent and well-documented case highlighted by investigators, the scammers took aim at the widely recognized “1Feex” wallet. This specific address holds approximately 80,000 Bitcoin, which historical blockchain tracking and industry consensus indicate were stolen during the infamous Mt. Gox exchange security breach years ago.
The perpetrators crafted a malicious on-chain message linked to this high-profile address, directing anyone monitoring the wallet to a fraudulent external website. This deceptive web portal is designed to impersonate Salomon Brothers, a prominent and historical Wall Street firm that has long since ceased its traditional operations under that identity.
Upon visiting the fraudulent website, visitors are greeted with a fabricated legal notice asserting that the targeted Bitcoin wallet is legally classified as “lost or abandoned.” The site then outlines a coercive process, inviting supposed rightful owners or claimants to step forward and prove their ownership. To validate their claims, victims are instructed to either sign an on-chain cryptographic message using their private key or submit sensitive personal documentation through an online web contact form hosted on the malicious platform. To create a false sense of urgency and compel immediate action, the notice explicitly states that if no formal response or verification is received by October 5, the wallet will be permanently deemed legally abandoned under fictitious legal frameworks.
Fake Legal Claims and Spurious Advisory Boards
As the scam began circulating within the cryptocurrency community, security analysts at BitMEX Research conducted a deeper investigation into the background of the website and the entities making the legal assertions. Their findings revealed that the digital platform shows no credible, legitimate link to the historical Salomon Brothers firm, its corporate successors, or its former leadership team.
While the fraudulent website attempts to establish an aura of legitimacy by displaying a public list of real individuals who genuinely worked at Salomon Brothers during the 1980s, investigators confirmed that none of these former professionals have any association whatsoever with the new and spurious entity orchestrating the crypto campaign.
BitMEX Research noted that the operational tactics and framing of this campaign bear striking similarities to earlier, controversial controversies involving high-profile figures such as Calvin Ayre. Ayre had previously funded separate legal actions and maneuvers concerning the exact same historical Bitcoin address, establishing a precedent of legal and public attention focused on the dormant funds.
Detailing the deception behind the current campaign, BitMEX Research stated that the links between the shell company behind the website and the historical institution are entirely fabricated. The firm pointed out that while the site features an advisory board containing the names of real individuals from the financial sector’s past, these people appear to have no connection to the fraudulent operation.
Members of the wider cryptocurrency community quickly weighed in on social media and industry forums as news of the scam spread. Security-conscious observers noted that a legitimate wallet owner attempting to prove activity or operational control would naturally choose to move a nominal, small amount of Bitcoin rather than transferring a full balance or exposing private keys and personal data to an unknown entity.
These glaring operational red flags have led many analysts and blockchain sleuths to suspect that the campaign is not a genuine legal reclamation effort, but rather a broader social engineering scheme. The primary objective appears to be harvesting sensitive personal information, cryptographic credentials, and private keys under the guise of an official legal proceeding.
BitMEX has strongly emphasized that cryptocurrency users, especially those holding older or dormant assets, should exercise extreme caution, avoid interacting with the suspicious contact form, and refrain from providing any personal details or cryptographic signatures.
The emergence of these specialized social engineering tactics highlights the growing complexity and psychological sophistication of modern crypto-related fraud. Malicious actors are increasingly moving beyond simple phishing emails and compromised browser extensions, deploying on-chain data injection and elaborate corporate impersonation to target high-value digital assets.
This sophisticated wave of attacks arrives against a backdrop of escalating financial losses across the digital asset ecosystem. Industry data indicates that in the first half of 2025 alone, hackers and malicious actors successfully stole over $2.1 billion across 75 separate security incidents. This staggering figure represents a concerning 10% increase in total stolen funds compared to the same tracking period in the previous year, driven in large part by the intensification of state-backed hacking groups and coordinated social engineering campaigns targeting both institutional and individual holders.
