By Asro 
Analysts at BitMEX Research have raised a critical security alarm regarding a sophisticated new scam campaign specifically targeting early Bitcoin holders, with a primary focus on wallets dating back to the foundational years of the network, particularly 2011. The fraudulent scheme relies on a clever mixture of on-chain data manipulation and elaborate social engineering to trick dormant account owners into relinquishing sensitive personal details or private key access.
According to the intelligence gathered by the research firm, the malicious actors behind this operation are systematically exploiting long-dormant cryptocurrency addresses. They achieve this by injecting false transactions and misleading, coercive messages directly into the blockchain via OP_Return outputs. This particular function is an optional field native to Bitcoin transactions that allows users to append a small amount of arbitrary data to a ledger entry. While typically used for digital proof-of-existence, timestamping, or embedding small notes, bad actors are increasingly weaponizing it to deliver targeted psychological lures straight to the blockchain histories of high-value, inactive accounts.
High-Profile Targets and Elaborate Impersonation
The scope of the campaign became glaringly apparent when the perpetrators set their sights on one of the most famous and heavily monitored dormant addresses in cryptocurrency history: the legendary "1Feex" wallet. This specific address currently holds approximately 80,000 Bitcoins, a massive digital fortune believed by blockchain investigators and security experts to have been illicitly siphoned during the infamous Mt. Gox exchange security breach years ago.
Rather than attempting a direct technical hack—which remains virtually impossible without cracking the underlying cryptographic security of the private keys—the attackers deployed a psychological trap. They meticulously crafted an on-chain message via the OP_Return field that directs unsuspecting observers or automated wallet watchers to a fraudulent, highly deceptive website. This imposter web portal was deliberately designed to impersonate Salomon Brothers, a well-known historical Wall Street firm.
Upon visiting the fraudulent destination, targets are met with a fabricated legal notice. The site asserts that the specific dormant wallet in question is legally classified as "lost or abandoned." To manufacture a false sense of urgency and legitimacy, the notice instructs the supposed rightful owners to step forward and prove their claim immediately. The platform demands that victims either sign an on-chain cryptographic message using their master private key or submit comprehensive personal documentation through an embedded web-based contact form. To compound the psychological pressure, the fake legal advisory warns that if no official response or ownership claim is registered by October 5, the wallet will officially and permanently be deemed legally abandoned by the state or corporate claimants.
Unraveling the Fake Legal Claims
As the campaign began circulating within select cryptocurrency security circles, analysts at BitMEX Research immediately began dissecting the infrastructure behind the fraudulent portal, uncovering glaring discrepancies that exposed the operation as a pure fraud.
The research firm explicitly warned that the website hosting the legal notice displays zero credible, verifiable ties to the genuine Salomon Brothers institution or its historical leadership structure. While the scammers attempted to build a veneer of institutional credibility by publishing a list of real individuals who genuinely worked at the Wall Street firm during the 1980s, rigorous checks revealed that none of these former professionals have any affiliation whatsoever with this newly minted and spurious corporate entity.
Furthermore, security experts noted stylistic and operational parallels between this current campaign and earlier, controversial maneuvers associated with figures like Calvin Ayre, who previously funded complex legal proceedings concerning the very same 1Feex Bitcoin address. This historical crossover appears to have been weaponized by the scammers to make their fake narrative sound marginally more plausible to anyone casually researching the address’s legal history.
BitMEX Research detailed the disconnect in their findings, stating that the connections claimed by the website are entirely manufactured. While pointing out the inclusion of legitimate former employees on an advisory board page, the firm reiterated that these individuals operate completely independently and maintain no link to the fraudulent platform.
The Community Response and Social Engineering Risks
As word of the warning spread across social media channels and researcher forums, members of the broader cryptocurrency community quickly weighed in on the mechanics of the attack. Industry veterans pointed out that if a wallet owner actually wanted to prove the active status of a dormant address, they could easily do so simply by moving a negligible fraction of a Bitcoin to establish current control, rather than risking the transfer of a full balance or handing over administrative documentation to an unverified third party.
This glaring logical flaw led many cybersecurity analysts to conclude that the entire operation is not designed to execute a direct on-chain theft, but rather functions as a wider social engineering scam. The primary objective appears to be the harvesting of sensitive personal identifiable information, identity documents, or cryptographic credentials under the convincing guise of a formal legal proceeding.
BitMEX Research strongly emphasized that cryptocurrency holders should exercise extreme caution, advising users to completely ignore the fraudulent contact forms and under no circumstances provide personal details, identification, or cryptographic proofs to the web portal.
The sudden emergence of these tailored, legally themed scams highlights the escalating sophistication and complexity of modern cryptocurrency fraud. Financial losses continue to mount across the digital asset ecosystem as bad actors deploy increasingly psychological tactics. In the first half of 2025 alone, malicious actors and state-backed hacking syndicates successfully stole over $2.1 billion across 75 distinct security incidents, representing a troubling 10% increase in stolen capital compared to the exact same period in the previous year. As these threats continue to evolve, blockchain security analysts recommend heightened vigilance across both active traders and long-term crypto holders alike.
Layla Zulfa 
Muslim