Security analysts at BitMEX Research have issued an urgent warning to the cryptocurrency community regarding a sophisticated and emerging scam campaign specifically targeting early Bitcoin holders, with a particular focus on legacy wallets dating back to 2011.
According to the intelligence gathered by the research firm, the malicious actors behind this campaign are systematically exploiting long-dormant blockchain addresses. They achieve this by injecting false transactions and misleading, coercive messages directly onto the ledger via OP_Return outputs. This optional field within a Bitcoin transaction allows users to embed arbitrary data into the blockchain, a feature that is increasingly being subverted by bad actors to launch social engineering attacks.
The scale and audacity of the campaign are highlighted by a heavily scrutinized, well-documented case involving the infamous "1Feex" wallet. This prominent address holds approximately 80,000 Bitcoins that are widely believed to have been stolen during the historic and catastrophic collapse of the Mt. Gox exchange years ago. In this instance, the attackers meticulously crafted an on-chain message designed to lure anyone monitoring or claiming ownership of the funds toward a fraudulent, highly deceptive website.
Fake Legal Claims and Sophisticated Impostors
The malicious website engineered by the scammers goes to great lengths to appear legitimate, impersonating the defunct Wall Street investment firm Salomon Brothers. Upon visiting the fraudulent platform, targets are greeted with a fabricated legal notice asserting that their long-dormant wallet has been officially designated as "lost or abandoned."
To reclaim or protect these massive digital asset holdings, the fake legal notice instructs supposed owners to verify their identity and prove their claim. The platform demands that victims either sign an on-chain message using their private key or submit sensitive personal documentation through an embedded web contact form. Furthermore, the notice introduces intense psychological pressure through artificial urgency, stating that if no formal response or claim is received by October 5, the wallet will be permanently and legally deemed abandoned by the state or corporate claimants.
BitMEX Research thoroughly investigated the claims presented on the fraudulent platform and quickly uncovered glaring discrepancies. The analysts warned that the website shows absolutely no credible corporate, legal, or historical link to the real Salomon Brothers or its former leadership team. While the fraudulent operators attempted to manufacture an aura of authenticity by publishing a list of real individuals who genuinely worked at the investment firm during the 1980s, none of those former employees have any known association with this newly formed, spurious entity.
The research platform noted that this deceptive approach bears striking tactical similarities to earlier, controversial campaigns. Observers pointed out parallels to efforts previously associated with figures like Calvin Ayre, who has historically funded legal actions and public disputes involving the exact same Bitcoin address.
BitMEX Research detailed the deception in a public statement, emphasizing the disconnect between the real historical figures and the current perpetrators: "The links between this company and this website are fake. There is a page with an ‘advisory board’ that contains real people who worked at Salomon Brothers in the 1980s, however, these people seem to have no link to this new spurious entity."
Community Warnings and the Broader Threat Landscape
As news of the campaign spread across the digital asset ecosystem, experienced community members and blockchain investigators quickly weighed in to debunk the technical and legal validity of the scheme. Industry analysts noted that any legitimate wallet owner seeking to prove ongoing activity or control over a dormant address would simply need to move a small, negligible amount of Bitcoin rather than transferring their full, multi-million-dollar balance or submitting sensitive personal documentation.
This glaring logical flaw has led security researchers and community watchdogs to conclude that the entire campaign is part of a broader, highly calculated social engineering effort. The ultimate objective of the attackers appears to be gathering sensitive personal information, private keys, or credentials under the false pretext of a binding legal proceeding.
In light of these findings, BitMEX reiterated its strong advisory to the public, urging all cryptocurrency holders, particularly those managing legacy or dormant accounts, to completely ignore the on-chain messages and avoid interacting with the contact form or providing any personal details whatsoever.
The emergence of these intricate social engineering tactics underscores the steadily growing complexity and evolution of cryptocurrency-related fraud. Malicious actors are continuously moving beyond traditional malware and phishing emails, adopting corporate impersonation and on-chain data injection to target high-value targets.
This sophisticated wave of attacks arrives against the backdrop of an already alarming year for digital asset security. According to industry tracking data, hackers and fraudulent entities managed to steal over $2.1 billion across 75 separate security incidents during the first half of 2025 alone. This staggering figure represents a notable 10% increase in total losses compared to the same tracking period in 2024, driven in large part by state-backed hacking groups and coordinated syndicates ramping up their offensive capabilities across the global crypto economy.
