Analysts at BitMEX Research have raised a critical security alarm regarding a sophisticated new scam scheme specifically targeting early Bitcoin holders, with a primary focus on wallets dating back to the foundational years of the cryptocurrency, particularly 2011. The fraudulent campaign relies on exploiting long-dormant blockchain addresses by injecting deceptive transactions and misleading messages directly into the public ledger using OP_Return outputs, which are an optional field in Bitcoin transactions capable of carrying arbitrary data.
Security researchers note that this method allows malicious actors to leave permanent, unchangeable text notes attached to specific historic addresses, ensuring that anyone monitoring those legacy wallets or analyzing blockchain explorers will encounter the fabricated notice.
In one prominent and well-documented case highlighted by the researchers, the scammers set their sights on the heavily scrutinized "1Feex" wallet. This particular address holds approximately 80,000 Bitcoin that are widely believed to have been stolen during the historic hack of the Mt. Gox exchange in its early days.
The attackers constructed a specialized message linked to this address, directing unsuspecting viewers to a fraudulent, newly minted website that brazenly impersonates the long-defunct Wall Street financial institution Salomon Brothers.
Upon visiting the fraudulent portal, users are greeted with a fabricated legal notice asserting that the targeted wallet is legally classified as "lost or abandoned." The site then prompts supposed owners or individuals claiming control over the keys to prove their legitimacy.
To accomplish this, the fake platform invites victims to either sign an on-chain message utilizing their private key or submit sensitive personal documentation and identifying data through a built-in web contact form. To create a strong sense of panic and urgency, the notice explicitly states that if no formal response or claim is received by October 5, the wallet will be permanently deemed legally abandoned under fictitious statutory rules.
Fake Legal Claims and Fabricated Advisory Boards
As BitMEX Research investigated the underlying infrastructure and claims of the website, they quickly discovered that the platform bears no credible connection whatsoever to the real Salomon Brothers or its historical leadership structure.
While the fraudulent website attempts to establish an aura of legitimacy by displaying a public list of real individuals who genuinely worked at the prestigious financial firm during the 1980s, none of those former employees appear to have any actual association with this newly emerged and spurious entity.
Researchers noted that this deceptive tactic bears striking similarities to earlier, highly controversial campaigns associated with public figures such as Calvin Ayre, who previously funded complex legal actions involving the exact same high-value Bitcoin address. However, the current iteration leans heavily into outright impersonation and social engineering rather than standard civil litigation.
In a public statement detailing the mechanics of the operation, BitMEX Research outlined the disconnect between the website’s claims and reality, emphasizing the fraudulent nature of the organizational ties.
"The links between this company and this website are fake," BitMEX Research stated. "There is a page with an ‘advisory board’ that contains real people who worked at Salomon Brothers in the 1980s, however, these people seem to have no link to this new spurious entity."
Following the public disclosure by BitMEX, various members of the broader cryptocurrency community weighed in on social media and forums, pointing out glaring technical inconsistencies in how legitimate wallet recovery or ownership verification works in practice.
Commenters noted that genuine wallet owners attempting to prove activity or ownership on the blockchain would typically choose to move a nominal, tiny amount of Bitcoin rather than risking their full balance or interacting with questionable web portals.
This glaring mismatch between standard cryptographic best practices and the demands of the fraudulent website has led many security analysts to suspect that the entire campaign is part of a much broader, coordinated social engineering effort designed to harvest sensitive personal information, private keys, or credentials under the false pretext of a legal compliance procedure.
Given the high-stakes nature of historical cryptocurrency holdings, security experts have reiterated strong warnings that users should completely avoid interacting with the provided contact forms, clicking suspicious links, or disclosing any confidential information.
The sudden emergence of these elaborate, legally themed scams highlights the continuously growing complexity and sophistication of crypto-related fraud in the digital asset ecosystem.
This evolving threat landscape comes amid a broader surge in malicious activity across the industry. Financial tracking reports indicate that in the first half of the year alone, hackers and cybercriminal syndicates successfully stole over $2.1 billion across 75 separate security incidents, representing a notable 10% increase in total losses compared to the same period in the previous year. As attackers continue to refine their psychological manipulation tactics alongside technical exploits, security analysts urge long-term holders to maintain heightened vigilance regarding unsolicited legal notices delivered via the blockchain.
