By Lina Irawan 
Cryptocurrency analysts have issued a widespread security alert warning early Bitcoin holders of a sophisticated and evolving scam. The malicious campaign specifically targets long-dormant cryptocurrency wallets dating back to the pioneering days of the network in 2011, leveraging deceptive legal pretexts, on-chain data manipulation, and fraudulent websites to trick unsuspecting digital asset owners.
According to a recent report by analytics firm BitMEX Research, the emerging threat exploits long-inactive addresses by injecting false transactions and misleading messages directly onto the Bitcoin blockchain. The attackers utilize OP_Return outputs, an optional field within Bitcoin transactions that allows users to attach arbitrary pieces of data to a ledger entry. By pushing customized payloads into these fields, the perpetrators manage to attach text-based lures to dormant addresses, hoping that original owners or individuals monitoring historical accounts will notice the unusual on-chain activity and take the bait.
One of the most notable cases documented in the campaign involves a high-profile address commonly known in the crypto community as the “1Feex” wallet. This specific wallet holds approximately 80,000 Bitcoin, a massive fortune that historical blockchain tracking and exchange records tie back to the infamous security breach of the Mt. Gox exchange. Because of the sheer value and the historical visibility of the address, it represents a lucrative target for bad actors seeking to trick whoever might claim rightful ownership or access to the keys.
In this particular instance, the attackers crafted an on-chain message directing anyone monitoring the address to visit a fraudulent website. This malicious web portal was carefully designed to impersonate Salomon Brothers, a well-known historical Wall Street investment banking firm that has long since ceased independent operations under its original corporate structure.
Upon visiting the fraudulent site, potential victims are greeted with a fabricated legal notice. The document asserts that the targeted wallet is legally considered "lost or abandoned." To manufacture a sense of urgency and lend an air of legal legitimacy to the proceeding, the site invites supposed owners to step forward and prove their claim. The instructions demand that victims either sign an on-chain cryptographic message using the wallet’s private key or submit sensitive personal documentation through an online contact form hosted on the portal. The fraudulent notice even establishes a firm deadline, warning that if no response is received by October 5, the wallet will be officially deemed abandoned under supposed legal frameworks.
Fake Legal Claims and Impersonation Tactics
BitMEX Research investigated the claims made on the fraudulent website and quickly uncovered a web of deception. Analysts warned that the platform displays no credible, verifiable link to the real Salomon Brothers or its former corporate leadership.
While the scammers attempted to build credibility by listing real individuals who once worked at the prestigious firm during the 1980s on a fake "advisory board" page, further scrutiny revealed that these former Wall Street professionals have absolutely no connection to the newly minted and spurious entity operating the website. The inclusion of authentic names and professional histories is a classic social engineering tactic designed to lower the guard of targeted individuals by creating a false sense of institutional authority.
Industry observers have also drawn parallels between this current campaign and past controversies. Analysts noted that the approach bears a striking resemblance to earlier schemes associated with polarizing figures such as Calvin Ayre, who previously funded legal actions and public campaigns involving the exact same Bitcoin address. However, whether the current threat actors have any direct affiliation or are simply capitalizing on previously publicized lore surrounding the address remains uncertain.
BitMEX Research highlighted the deceptive nature of the setup in a public advisory, stating that the links between the shell company and the website are entirely fabricated. The firm specifically pointed out the advisory board featuring real former Salomon Brothers employees, reiterating that these individuals seem to have no link whatsoever to the spurious entity running the campaign.
Community Response and Broader Security Implications
As details of the campaign spread across social media and developer forums, cryptocurrency community members quickly weighed in to debunk the claims. Many seasoned holders and blockchain analysts pointed out glaring operational security flaws in the scammers’ narrative. For instance, legitimate wallet owners looking to prove ongoing activity or control over a dormant address would normally just need to move a negligible amount of Bitcoin to a new address, rather than exposing private keys or surrendering personal documentation through a centralized, unverified web portal.
These red flags have led many security experts to conclude that the entire campaign is part of a broader, highly targeted social engineering scam designed primarily to harvest sensitive personal information, cryptographic credentials, or private keys under the guise of compliance and legal obligation.
Security professionals have reiterated strict warnings advising crypto holders never to interact with unverified contact forms, input private keys into unknown websites, or share personal identifying information based on unsolicited legal notices found on-chain.
The emergence of this wallet-targeting scheme underscores the ever-increasing complexity and persistence of cryptocurrency-related fraud. The threat landscape continues to evolve as bad actors develop more creative methods to target both legacy holders and institutional participants. According to industry tracking data, the broader ecosystem has faced intense security pressures, with hackers and scammers stealing over $2.1 billion across 75 separate incidents during the first half of 2025 alone—representing a significant 10% increase compared to the same tracking period in the previous year. As on-chain assets appreciate in value, analysts expect campaigns targeting legacy, dormant, and high-balance wallets to remain a persistent challenge for the digital asset community.
Asro 
Layla Zulfa 
Muslim