By Lina Irawan 
Analysts at BitMEX Research have raised a serious security alarm regarding a sophisticated new scam campaign specifically targeting early Bitcoin holders, with a primary focus on individuals and entities holding dormant wallets dating back to 2011.
According to the research firm’s findings, the malicious scheme exploits long-dormant cryptocurrency addresses by injecting false transactions and misleading, coercive messages directly onto the blockchain. Attackers are utilizing OP_Return outputs—an optional field built into Bitcoin transactions that allows users to permanently attach a small amount of arbitrary data to a ledger entry—to broadcast their fraudulent narratives to anyone monitoring these historical addresses.
In one prominent and well-documented case highlighted by analysts, the scammers set their sights on the heavily scrutinized "1Feex" wallet. This specific address holds approximately 80,000 Bitcoin, a massive fortune that is widely believed to have been stolen during the catastrophic 2011 hack of the now-defunct Mt. Gox exchange. To make their approach appear legitimate, the attackers crafted a customized on-chain message directing anyone monitoring or controlling the address to a fraudulent website meticulously designed to impersonate Salomon Brothers, the legendary and historic Wall Street firm.
Upon visiting the fraudulent portal, victims are greeted by a fabricated legal notice asserting that the targeted cryptocurrency wallet has been officially classified as "lost or abandoned." The deceptive platform then invites supposed rightful owners or claimants to step forward and prove their identity and ownership. To do so, the site instructs victims to either sign an on-chain message using the private key associated with the address or submit sensitive personal documentation through an online web contact form. Adding a heavy sense of false urgency and pressure, the notice explicitly states that if no formal response or claim is received by October 5, the wallet will be permanently deemed legally abandoned under fictitious legal frameworks.
Fake Legal Claims and Impersonation Tactics
Following the discovery of the campaign, BitMEX Research conducted a deeper investigation into the background of the website and the legal claims being presented. The firm quickly confirmed that the website bears no credible connection whatsoever to the real Salomon Brothers or its historical leadership structure. While the fraudulent platform attempts to borrow an aura of legitimacy by displaying a public list of real individuals who genuinely worked at the investment bank during the 1980s, none of these former professionals have any actual association with the spurious entity running the scam.
Furthermore, analysts noted that the operational approach and overarching strategy bear a striking resemblance to an earlier, controversial campaign associated with prominent industry figures such as Calvin Ayre, who previously funded complex legal actions involving the very same historical Bitcoin address.
In a public statement detailing the threat, BitMEX Research noted the deceptive nature of the endorsements displayed on the fraudulent portal, stating that the links between the shell company and the website are entirely fabricated. The firm pointed out that the page featuring an advisory board composed of real historical figures from Salomon Brothers is merely a smoke screen designed to fool unsuspecting observers into trusting the legitimacy of the legal notice.
As news of the campaign spread across social media and developer forums, cryptocurrency community members quickly weighed in with their own technical analyses. Many seasoned participants pointed out that a legitimate wallet owner wishing to prove activity or operational control over an address does not need to navigate complex third-party legal portals or surrender private keys. Instead, a genuine owner could simply move a negligible amount of Bitcoin to demonstrate ongoing network activity rather than risking their full balance on an unverified platform.
These observations have led a growing number of security researchers and community members to suspect that the campaign is not actually designed to trick the original, long-gone owners of ancient wallets. Rather, security analysts believe it is part of a broader, highly targeted social engineering scam effort engineered to trick onlookers, researchers, or negligent custodians into surrendering sensitive personal information, credentials, or private keys under the false pretext of a high-stakes legal proceeding.
Given the severe risks involved, BitMEX Research has strongly emphasized that users, researchers, and cryptocurrency holders should strictly avoid interacting with the fraudulent contact form, visiting the malicious web domain, or providing any personal details or cryptographic signatures.
The rapid emergence and increasing sophistication of schemes targeting dormant blockchain assets serve as a stark reminder of the growing complexity and scale of modern cryptocurrency fraud. Malicious actors continue to innovate, shifting away from simple phishing links toward complex, multi-layered social engineering campaigns that weaponize blockchain data itself against unsuspecting market participants.
This localized threat arrives against the backdrop of an increasingly hostile security landscape across the broader digital asset ecosystem. According to industry tracking data, in the first half of 2025 alone, malicious hackers and sophisticated cybercriminal syndicates successfully stole over $2.1 billion across 75 separate security incidents. This staggering figure represents a notable 10% rise in total stolen funds compared to the same tracking period in the previous year, underscoring the urgent need for heightened vigilance among both retail holders and institutional custodians as digital asset values continue to climb.
Asro 
Layla Zulfa 
Muslim