Analysts at BitMEX Research have raised a serious security alarm regarding an emerging crypto scam specifically targeting early Bitcoin holders, with a particular focus on long-dormant wallets dating back to 2011.
According to the research firm, the sophisticated campaign exploits ancient, inactive addresses by injecting false transactions and misleading messages directly into the blockchain. These malicious payloads are delivered via OP_Return outputs, which are an optional field in Bitcoin transactions capable of carrying arbitrary data. By embedding data directly into the public ledger, the threat actors ensure that anyone inspecting these historical addresses via block explorers or wallet interfaces encounters their fabricated claims.
In one prominent and well-documented case uncovered by analysts, the scammers set their sights on the heavily scrutinized "1Feex" wallet. This address holds roughly 80,000 Bitcoin, a massive fortune that is widely believed to have been stolen during the catastrophic 2011 breach of the Mt. Gox exchange. To execute the ruse, the attackers crafted a customized message containing a link that redirects unsuspecting visitors to a fraudulent website meticulously designed to impersonate the defunct Wall Street investment firm Salomon Brothers.
Upon arriving at the malicious web portal, visitors are greeted by a forged legal notice stating that the targeted wallet is legally classified as "lost or abandoned." The site then prompts supposed owners to step forward and prove their rightful claim. Victims are instructed to either sign an on-chain message using their private key—which could instantly compromise their cryptographic security—or submit sensitive personal documentation through an embedded web contact form. To create a false sense of urgency, the notice explicitly warns that if no legitimate owner responds to the claim by October 5, the wallet will be permanently deemed legally abandoned under fictitious statutory rules.
Fake Legal Claims and Impersonation Tactics
Following the discovery of the campaign, BitMEX investigated the fraudulent website and confirmed that it bears no credible connection to the real Salomon Brothers or its historical leadership structure. While the fraudulent operators attempted to lend an air of legitimacy to the platform by publishing a list of real individuals who genuinely worked at the investment bank during the 1980s, none of those former employees have any known association with this newly emerged and spurious entity.
Industry analysts have noted that the operational approach closely mirrors past controversies. Observers pointed out that the tactic is reminiscent of earlier campaigns associated with controversial figures such as Calvin Ayre, who previously funded legal action surrounding the exact same high-profile Bitcoin address. However, the current iteration heavily relies on digital impersonation and psychological pressure to achieve its goals.
BitMEX Research detailed the deception in a public advisory, noting the fabricated nature of the affiliations. The firm stated that the links between the shell company and the website are entirely fraudulent. While acknowledging the presence of an advisory board page featuring real professionals from Salomon Brothers’ history, the research team emphasized that these individuals appear to have zero link to the new spurious entity orchestrating the wallet campaign.
Members of the broader cryptocurrency community have also weighed in on the mechanics of the scam, pointing out glaring logical flaws in the attackers’ premise. Experienced developers and security researchers noted that a legitimate wallet owner attempting to prove ongoing control or activity would simply need to move a negligible amount of Bitcoin to a fresh address to demonstrate active custody. Demanding private key signatures through an unverified third-party portal or requesting extensive personal documentation strongly suggests that the campaign is designed for data harvesting rather than legitimate legal asset recovery.
The Broader Threat of Social Engineering
Security experts suspect that this campaign represents just one front in a much broader social engineering scam effort designed to harvest sensitive personal information and private keys under the guise of official legal proceedings. As blockchain analysis tools become more sophisticated, malicious actors are increasingly turning away from simple phishing emails and moving toward on-chain injection vectors that directly target high-net-worth holders who may have neglected their old holdings for over a decade.
In light of these findings, BitMEX and other industry security analysts have strongly emphasized that users should exercise extreme caution. Bitcoin holders—particularly those managing legacy wallets from the network’s early years—have been urged never to interact with unverified contact forms, click suspicious links embedded in blockchain transaction data, or disclose sensitive personal details and private keys to third-party entities claiming to represent legal or governmental authorities.
The emergence of such targeted schemes underscores the steadily growing complexity and financial scale of crypto-related fraud. According to recent industry data, the macroeconomic landscape of digital asset security continues to face severe headwinds. In the first half of 2025 alone, malicious hackers and sophisticated syndicates managed to steal over $2.1 billion across 75 separate security incidents. This staggering figure represents a concerning 10% increase in stolen funds compared to the same period in 2024, driven in part by state-backed hacking groups and increasingly elaborate social engineering vectors targeting both institutional custodians and individual holders alike.
