By Lina Hope 
According to the research firm’s findings, the fraudulent campaign leverages on-chain data manipulation to target long-inactive addresses. The attackers exploit the blockchain by injecting false transactions and misleading messages directly into the targeted wallets using OP_Return outputs, which are an optional field within Bitcoin transactions capable of carrying small amounts of arbitrary text data.
The scope of this campaign is broad, but a high-profile case highlighted by analysts involves the infamous "1Feex" wallet. This prominent address holds approximately 80,000 Bitcoins that are widely believed to have been illicitly acquired during the historic 2011 hack of the Mt. Gox exchange. In this specific instance, the attackers engineered a tailored message within the transaction data that directs unsuspecting victims or observers to a meticulously crafted, fraudulent website designed to impersonate Salomon Brothers, the legendary and defunct Wall Street investment bank.
Upon visiting the fraudulent portal, users are greeted with a fabricated legal notice asserting that the associated wallet has been classified as "lost or abandoned." The site then prompts any supposed rightful owners or claimants to step forward and verify their identity and ownership. To initiate the recovery process, the platform instructs victims to either sign an on-chain message utilizing their private key or submit sensitive personal documentation through an embedded web contact form. The fake notice establishes a strict psychological pressure point, warning that if no valid claim or response is received by October 5, the wallet will officially be deemed legally abandoned and forfeited.
Fake legal claims and impersonation tactics
BitMEX Research cautioned that the fraudulent website exhibits no credible legal or operational ties to the actual Salomon Brothers institution or its former corporate leadership. Although the bad actors populated a page on the site with an "advisory board" listing real individuals who genuinely worked at Salomon Brothers during the 1980s, none of these former Wall Street professionals have any association with this newly emerged and spurious entity.
The research platform noted that this deceptive approach bears striking tactical similarities to earlier, controversial campaigns. Previous legal maneuvers involving the exact same "1Feex" Bitcoin address have historically attracted attention from figures such as Calvin Ayre, though the current scheme appears to function primarily as an opportunistic phishing and social engineering trap rather than a legitimate legal proceeding.
"The links between this company and this website are fake," BitMEX Research stated in its published advisory. "There is a page with an ‘advisory board’ that contains real people who worked at Salomon Brothers in the 1980s, however, these people seem to have no link to this new spurious entity."
As news of the scam spread across digital asset circles, members of the broader cryptocurrency community quickly weighed in to expose the technical and logical flaws in the fraudsters’ narrative. Security-minded observers pointed out that a legitimate wallet owner seeking to prove active control over an address would simply need to broadcast a routine, minor transaction—such as moving a tiny fraction of a Bitcoin—to signal activity, rather than handing over sensitive private keys or personal identification documents through an unverified web portal.
These glaring inconsistencies have led industry analysts and cybersecurity experts to conclude that the campaign is fundamentally a social engineering operation. The primary objective appears to be harvesting sensitive private keys, credentials, or personal information under the guise of an official legal obligation, which the perpetrators could then leverage to drain targeted funds or commit further identity-related fraud.
Given the severe risks involved, BitMEX has strongly emphasized that cryptocurrency holders, especially those managing legacy or long-dormant assets, should completely ignore these on-chain messages and avoid interacting with the contact form or submitting any personal information whatsoever.
The emergence of these complex social engineering schemes underscores the continuously evolving threat landscape surrounding digital assets. Fraudsters are increasingly deploying psychological tactics, institutional impersonation, and on-chain injection techniques to deceive unsuspecting participants. This malicious activity unfolds against a backdrop of escalating financial losses across the broader ecosystem; during the first half of 2025 alone, malicious actors and hackers successfully stole over $2.1 billion across 75 separate security incidents, representing a concerning 10% increase in stolen capital compared to the same period in the previous year.
Asro 
Layla Zulfa 
Muslim