By Laily UPN 
Security researchers at BitMEX Research have issued an urgent warning to early cryptocurrency investors, uncovering a novel and increasingly sophisticated scam specifically targeting dormant Bitcoin wallets dating back to the earliest days of the network, particularly those originating around 2011.
According to the intelligence gathered by the firm, the malicious campaign relies heavily on blockchain-level data injection to target long-inactive addresses. The perpetrators are exploiting the network’s design by injecting false transactions and deceptive messages directly into the blockchain via OP_Return outputs—an optional field built into Bitcoin transactions explicitly designated for carrying arbitrary data payloads.
By leveraging this mechanism, the threat actors are directly broadcasting misleading legal threats and instructions to historical addresses, hoping to ensnare holders who may have locked away substantial digital fortunes more than a decade ago and have only recently checked back into the ecosystem.
High-Profile Targets and Elaborate Imposture
The sheer ambition of the campaign is underscored by the high-profile targets chosen by the scammers. In one thoroughly documented investigation, the attackers directed their sights toward the notoriously famous “1Feex” wallet address. This specific Bitcoin address currently holds approximately 80,000 BTC, a massive cache that historical industry data and investigations attribute to funds stolen during the infamous Mt. Gox exchange hack of 2011.
To execute the ploy, the attackers meticulously crafted an on-chain message linked to the 1Feex address that directs unsuspecting or curious observers to a carefully constructed fraudulent website. This malicious domain is designed to brazenly impersonate Salomon Brothers, a legendary and defunct Wall Street investment banking firm that played a massive role in traditional finance before being absorbed into Citigroup decades ago.
Once a target or observer navigates to the fraudulent domain, they are immediately confronted with a fabricated legal notice. The digital document asserts with an air of legal authority that the targeted long-dormant Bitcoin wallet is legally categorized as "lost or abandoned."
From there, the platform outlines a fraudulent recovery pathway, instructing the supposed rightful owners to step forward and prove their active claim over the billions in digital assets. The instructions demand that users either sign an on-chain message using their historic private key or submit deeply sensitive personal documentation through an official-looking web contact form hosted on the portal. To induce panic and force a hasty response, the fake legal notice establishes a strict deadline of October 5, warning that if no verified claim or response is received by that date, the wallet will be permanently declared legally abandoned under fabricated jurisdictional frameworks.
Unraveling the Fake Legal Claims
As the warning circulated throughout the global cybersecurity and cryptocurrency communities, thorough investigations by BitMEX Research quickly exposed the fraudulent foundations of the website. Analysts confirmed that the web platform possesses zero credible affiliations, legal connections, or partnerships with the real historical Salomon Brothers entity or its former executive leadership and corporate legacy.
While the fraudulent website attempts to establish an aura of legitimacy by publishing a list of real, verifiable individuals who genuinely worked as professionals at Salomon Brothers during the 1980s, none of these former Wall Street veterans have any connection whatsoever to the newly emerged and spurious entity behind the digital scheme.
Researchers noted that the mechanics and presentation of the attack bear striking similarities to previous controversies within the cryptocurrency ecosystem. Specifically, the approach evokes memories of earlier legal maneuvers and campaigns associated with polarizing industry figures such as Calvin Ayre, who previously financed and spearheaded various legal battles and ownership claims involving the exact same historic Bitcoin address.
Emphasizing the disconnect between the fraudulent entity and reality, BitMEX Research detailed their findings regarding the fabricated corporate structure in a public advisory statement:
"The links between this company and this website are fake. There is a page with an ‘advisory board’ that contains real people who worked at Salomon Brothers in the 1980s, however, these people seem to have no link to this new spurious entity."
Community Response and Social Engineering Concerns
As news of the ongoing campaign spread across social media channels and developer forums, cryptocurrency community members and security analysts quickly weighed in with technical insights. Many seasoned network participants pointed out the glaring operational security flaws embedded within the scammers’ demands. For instance, cryptocurrency experts noted that legitimate wallet owners wishing to prove active control over a dormant address would never need to interact with a centralized legal contact form or expose sensitive personal documents. Instead, standard network verification simply requires moving a nominal, dust-like amount of Bitcoin from the address to demonstrate live cryptographic activity, thereby rendering the full balance transfer completely unnecessary for ownership proof.
These observations have led leading security researchers and community watchdogs to conclude that the entire operation is not a legitimate legal recovery effort, but rather a sophisticated social engineering scheme. The campaign appears meticulously designed to harvest sensitive personal data, exploit psychological pressure, and ultimately manipulate individuals into compromising their private keys under the guise of complying with a fictitious legal mandate.
Given the severity of the potential financial losses—especially considering the multi-billion-dollar valuation of the targeted wallets—BitMEX Research has strongly advised all network participants, early investors, and asset custodians to completely ignore the on-chain prompts. Users have been explicitly warned never to interact with the fraudulent contact forms, input private keys into unverified web interfaces, or submit personal documents under any circumstances.
The Escalating Threat Landscape
The emergence of this clever ‘lost wallet’ scam highlights the steadily growing sophistication and complexity characterizing modern cryptocurrency-related fraud and cybercrime. Threat actors are increasingly moving beyond simple phishing emails and fake token launches, opting instead for deep infrastructure-level manipulations and convincing social engineering setups that mimic traditional legal and financial institutions.
This incident arrives against a backdrop of escalating cyber threats targeting the broader digital asset economy. According to recent industry statistics and security reports tracking illicit activities, the first half of the year witnessed a staggering surge in criminal activity. Hackers and organized syndicates successfully stole over $2.1 billion across 75 separate and distinct security incidents during this timeframe alone. This figure represents a troubling 10% increase in total stolen funds compared to the exact same period in the previous year, driven in large part by increasingly aggressive, state-backed hacking groups and advanced cybercriminal rings refining their tactics to exploit human psychology and technical vulnerabilities alike.
Asro 
Layla Zulfa 
Muslim