Scam Alert Issued for Early Bitcoin Holders as Sophisticated ‘Lost Wallet’ Scheme Targets Dormant Addresses

Analysts at BitMEX Research have raised a critical security alarm regarding a sophisticated new scam campaign targeting early Bitcoin holders, with a particular focus on long-dormant wallets dating back to 2011. The fraudulent scheme appears to exploit historic, inactive blockchain addresses by systematically injecting false transactions and deceptive, misleading messages directly onto the ledger.

According to the intelligence gathered by BitMEX Research, the attackers are leveraging OP_Return outputs—an optional field built into Bitcoin transactions capable of carrying arbitrary data—to broadcast their malicious notifications. By embedding data directly into the blockchain, the scammers aim to catch the attention of anyone monitoring these legacy addresses, including automated blockchain explorers, data aggregators, and potentially original holders who may check their balances sporadically.

In one particularly high-profile documented case, the bad actors targeted the widely known and heavily scrutinized “1Feex” wallet. This particular address holds approximately 80,000 Bitcoin, a massive fortune that is widely believed to have been stolen during the catastrophic 2011 breach of the Mt. Gox exchange. The attackers crafted a specific, malicious transaction payload associated with this wallet, embedding a custom message designed to lure anyone monitoring the address into a trap.

The embedded data within the transaction links unsuspecting viewers to a fraudulent, highly deceptive website meticulously impersonating the defunct investment firm Salomon Brothers. Once a user visits the fraudulent site, they are confronted with a fabricated legal notice asserting that the targeted wallet is legally classified as "lost or abandoned."

Fake Legal Claims and High-Pressure Tactics

The fraudulent website deploys high-pressure social engineering tactics, urging supposed owners to step forward and prove their rightful claim to the digital assets. To accomplish this, the site instructs visitors to either sign an on-chain message utilizing the wallet’s original private key or submit extensive personal documentation through an embedded web contact form. To force compliance and induce panic, the fake legal notice introduces an artificial deadline, warning that if no response is received by October 5, the wallet will be permanently deemed legally abandoned and forfeited.

Security analysts at BitMEX have thoroughly debunked the legitimacy of the campaign, emphasizing that the website bears no credible connection to the real Salomon Brothers or its former leadership team. While the fraudulent platform attempts to build a veneer of authenticity by displaying a list of genuine individuals who historically worked at the prominent firm during the 1980s, investigators confirmed that none of these former executives have any association with the spurious entity running the website.

Drawing parallels to past controversies within the cryptocurrency ecosystem, BitMEX Research noted that the overarching approach bears a strong resemblance to earlier, highly publicized campaigns associated with figures such as Calvin Ayre, who previously funded legal action involving the exact same Bitcoin address. However, this new digital iteration shifts the methodology from public litigation maneuvers to direct, deceptive social engineering aimed squarely at extracting sensitive information or private keys.

BitMEX Research explicitly warned the broader crypto community about the nature of the threat, stating that the purported corporate links are entirely fabricated.

"The links between this company and this website are fake," BitMEX Research stated. "There is a page with an ‘advisory board’ that contains real people who worked at Salomon Brothers in the 1980s, however, these people seem to have no link to this new spurious entity."

Community Response and the Rising Threat of Crypto Fraud

As details of the campaign circulated across social media and developer forums, cryptocurrency community members quickly weighed in to debunk the claims and highlight the glaring security risks. Security-conscious observers pointed out that a legitimate wallet owner seeking to prove active control over an address would simply need to move a negligible amount of Bitcoin to verify activity, rather than turning over sensitive personal documentation or interacting with an unverified web contact form.

These community discussions have reinforced suspicions that the campaign is merely one piece of a much broader, highly organized social engineering effort. Fraudsters are increasingly utilizing legal pretexts, fabricated regulatory warnings, and intimidation tactics to trick cryptocurrency holders into compromising their private security parameters. Security experts have repeatedly emphasized that users should never interact with unverified contact forms, input private keys into third-party websites, or respond to unsolicited legal threats delivered via on-chain data fields.

The emergence of this targeted campaign highlights the growing sophistication and expanding complexity of crypto-related fraud in an evolving market. Malicious actors continue to innovate new vectors for exploitation, moving beyond simple phishing emails to leverage native blockchain functionalities like OP_Return data injection to lend an illusion of permanence and authority to their scams.

This incident arrives against a backdrop of escalating financial losses across the digital asset sector. According to recent industry data, the first half of 2025 alone witnessed hackers and cybercriminal syndicates steal over $2.1 billion across 75 separate security incidents. This staggering figure represents an alarming 10% increase compared to the same tracking period in 2024, driven in large part by increasingly aggressive state-backed hacking groups and coordinated social engineering campaigns targeting both institutional players and individual cryptocurrency holders.