Analysts at BitMEX Research have raised a critical security alarm regarding an emerging and sophisticated scam campaign targeting early Bitcoin holders, with a particular focus on dormant wallets dating back to the foundational eras of the cryptocurrency in 2011.
According to the intelligence gathered by the research firm, the fraudulent operation exploits long-inactive blockchain addresses by directly injecting false transactions and deceptive, coercive messages. These malicious actors are leveraging OP_Return outputs—an optional field within standard Bitcoin transactions that allows users to append a small amount of arbitrary data to the blockchain—to broadcast their fraudulent narratives directly onto the public ledger.
The scale and audacity of the campaign became apparent when attackers targeted one of the most infamous and heavily scrutinized addresses in cryptocurrency history: the legendary "1Feex" wallet. This specific wallet currently holds approximately 80,000 Bitcoin, assets that are widely believed to have been stolen during the catastrophic 2011 security breach of the Mt. Gox exchange, which was the dominant cryptocurrency trading platform of its era.
In the recent attack involving this address, the perpetrators crafted an on-chain message designed to lure anyone monitoring or claiming the wallet into visiting a fraudulent website. This malicious web portal was deliberately engineered to impersonate Salomon Brothers, a prominent and historical Wall Street investment bank that has long since ceased operations in its original form.
Fake Legal Claims and Coercive Tactics
Upon visiting the fraudulent portal, potential targets are presented with an official-looking legal notice. The site asserts that the targeted dormant wallet is legally classified as "lost or abandoned." To heighten the sense of urgency and lend an air of false legitimacy to the proceedings, the notice invites the supposed rightful owners to step forward and prove their ownership claims.
The fraudulent website demands that victims either sign an on-chain message utilizing their private cryptographic keys or submit extensive personal documentation through an embedded web contact form. To force compliance, the notice imposes a strict deadline, warning that if no valid response or claim is registered by October 5, the wallet will be permanently and legally deemed abandoned by the operators of the fake entity.
BitMEX Research swiftly debunked these assertions, warning the broader financial and cryptocurrency communities that the website bears no credible connection to the real Salomon Brothers or its historic leadership team. While the fraudulent platform attempts to manufacture credibility by displaying a directory of real individuals who genuinely worked at the investment bank during the 1980s, investigators confirmed that none of these former Wall Street professionals have any association whatsoever with this new, spurious entity.
Industry observers and cryptocurrency researchers have pointed out stylistic and strategic similarities between this current campaign and older controversies. Specifically, analysts noted that the approach is reminiscent of previous legal maneuvering associated with figures like Calvin Ayre, who previously financed legal actions centered around the exact same controversial Bitcoin address. However, this new digital iteration shifts the methodology from traditional legal disputes to a deceptive on-chain social engineering trap.
BitMEX Research highlighted the deceptive nature of the site in a public statement regarding the findings: "The links between this company and this website are fake. There is a page with an advisory board that contains real people who worked at Salomon Brothers in the 1980s, however, these people seem to have no link to this new spurious entity."
Growing Sophistication of Crypto Social Engineering
The cryptocurrency community has actively weighed in on the mechanics of the scam, with experienced developers and long-term participants noting glaring security flaws in the attackers’ premise. Security-conscious community members pointed out that a legitimate wallet owner wishing to prove activity or control over an address would merely need to move a negligible amount of Bitcoin from the address to signal ongoing oversight, rather than interacting with a third-party legal portal or transferring their entire capital balance.
This glaring discrepancy has led security analysts and blockchain investigators to conclude that the entire campaign is part of a broader, highly targeted social engineering effort. Rather than possessing the cryptographic keys required to move the funds directly, the attackers are relying on psychological manipulation to trick asset holders, estate representatives, or historical stakeholders into exposing sensitive private keys, seed phrases, or verifiable personal identity documents under the guise of a formal legal proceeding.
In light of these findings, BitMEX has issued an unambiguous warning to the cryptocurrency community, strongly advising all users, investors, and digital asset custodians never to interact with the suspicious contact forms, download unverified files, or disclose private credentials and personal information under any circumstances.
The emergence of this sophisticated wallet-targeting scam underscores the rapidly evolving threat landscape confronting the digital asset ecosystem. Fraudsters are continuously developing more complex, multi-layered schemes that blend blockchain mechanics with traditional psychological coercion. This incident arrives amid a troubling broader trend across the digital asset economy. According to recent industry tracking, crypto-related thefts and heists reached staggering heights during the first half of the year, with malicious actors stealing over $2.1 billion across 75 distinct security incidents—marking a notable 10% increase compared to the same tracking period from the previous year. As on-chain attacks and social engineering campaigns grow in both frequency and ingenuity, industry analysts emphasize that heightened vigilance remains the primary defense for long-term cryptocurrency holders.
