Analysts at BitMEX Research have raised a critical security alarm regarding a sophisticated new scam campaign specifically targeting early Bitcoin holders, with a primary focus on wallets and addresses dating back to the foundational days of the network in 2011. As blockchain forensics and crypto-related threats continue to evolve, bad actors are increasingly turning to creative social engineering tactics that blend technical manipulation on the blockchain with elaborate off-chain pretenses designed to deceive unsuspecting asset holders.
According to the intelligence gathered by BitMEX Research, the malicious campaign exploits long-dormant Bitcoin addresses by injecting false transactions and misleading data-carrying messages directly onto the blockchain. Attackers are utilizing OP_Return outputs—an optional field built into Bitcoin transactions that allows users to permanently store a small amount of arbitrary data on the ledger—to communicate directly with anyone monitoring these historic addresses. By embedding specific text and links into these outputs, the scammers hope to catch the attention of early adopters who may still check the balance of their legacy wallets after years of inactivity.
In one of the most prominent documented cases uncovered by researchers, the attackers targeted the widely recognized "1Feex" wallet. This specific address holds approximately 80,000 Bitcoins, a massive stash historically believed to be linked to funds stolen during the infamous 2011 hack of the Mt. Gox exchange. Capitalizing on the historical notoriety and immense value associated with this specific address, the perpetrators crafted a custom malicious payload. This on-chain message lures recipients to a meticulously designed fraudulent website that brazenly impersonates Salomon Brothers, the prominent Wall Street financial firm that ceased independent operations decades ago.
Upon visiting the fraudulent web portal, targets are greeted by a simulated legal notice claiming that the dormant wallet in question has been classified as "lost or abandoned" under various legal frameworks. The fake notice then demands that the supposed rightful owners come forward to prove their claim. To substantiate ownership, the site instructs visitors to either sign an on-chain message utilizing the private key associated with the ancient wallet or submit sensitive personal identification documentation through an online contact form provided on the platform. Adding a false sense of urgency to the proceedings, the notice warns that if no verified response or claim is registered by October 5, the wallet will officially be deemed legally abandoned and forfeited.
Fake Legal Claims and Fabricated Advisory Boards
As security analysts delved deeper into the operations behind the fraudulent website, it quickly became apparent that the entire legal premise was a complete fabrication. BitMEX Research warned the public that the website shows absolutely no credible, legitimate link to the real Salomon Brothers or its historic leadership structure. While the fraudulent operators attempted to lend an aura of authenticity to the platform by displaying a list of genuine individuals who actually worked at Salomon Brothers back in the 1980s, none of these former Wall Street executives have any association whatsoever with this new and spurious entity.
The research platform noted that the overall structure and aggressive legal posturing of this campaign bear striking similarities to earlier, highly controversial schemes. Specifically, observers pointed out parallels to tactics previously associated with controversial figures such as Calvin Ayre, who had previously funded legal actions and disputes involving the very same historical Bitcoin address. By wrapping their efforts in pseudo-legal jargon and fake institutional backing, the malicious actors aim to intimidate or convince targets that they face a strict deadline to reclaim assets that might otherwise be lost to legal proceedings.
Members of the broader cryptocurrency community have also weighed in on the mechanics of the scheme, highlighting major red flags that expose the amateurish flaws beneath the professional facade. Commentators pointed out that if a wallet owner truly wanted to prove activity and thwart any claims of abandonment, they could simply move a negligible amount of Bitcoin to establish an on-chain footprint, rather than transferring their entire multi-million or multi-billion-dollar balance or exposing sensitive private keys.
This glaring technical mismatch has led many analysts and community sleuths to conclude that the campaign is not actually about legal ownership at all, but is instead part of a much broader, highly calculated social engineering effort. The ultimate objective appears to be gathering sensitive personal information, private keys, or credentials under the false pretext of a legal compliance procedure, which can then be leveraged to compromise other digital assets held by the victims.
In light of these findings, BitMEX Research and other cybersecurity observers have issued clear warnings emphasizing that users and legacy holders must exercise extreme caution. Individuals should under no circumstances interact with the provided contact forms, click suspicious links embedded in on-chain transactions, or provide personal details and private keys to unverified third-party platforms claiming legal authority over blockchain assets.
The emergence of these inventive social engineering vectors highlights the steadily growing complexity and persistence of crypto-related fraud across the digital asset ecosystem. Malicious actors are continuously refining their methodologies to exploit human psychology alongside technological vulnerabilities, shifting away from simple malware toward elaborate, multi-layered deception campaigns.
Official data underscores the immense financial stakes driving these criminal enterprises. In the first half of 2025 alone, malicious actors, hackers, and cybercrime syndicates successfully stole over $2.1 billion across 75 separate security incidents worldwide. This alarming figure represents a notable 10% increase in total stolen funds compared to the same period in the previous year, demonstrating that digital asset security remains an ongoing challenge for both individual investors and industry infrastructure providers alike as threat actors ramp up their operations.
