By Siti Muinah 
Security analysts and researchers at BitMEX Research have raised a critical industry alarm regarding a sophisticated new scam campaign targeting early Bitcoin holders, particularly individuals and entities holding dormant wallet addresses dating back to the pioneering days of cryptocurrency in 2011.
According to the analytical firm, the fraudulent operation exploits long-inactive blockchain addresses by injecting deceptive transactions and misleading communications directly into the ledger. This is accomplished utilizing OP_Return outputs, an optional field built into Bitcoin transactions designed to store arbitrary data on-chain. By leveraging this feature, malicious actors can ensure that anyone monitoring or scanning these historical addresses encounters their fabricated directives.
The scope and ambition of the campaign were highlighted when the attackers targeted one of the most high-profile dormant addresses in the cryptocurrency ecosystem: the well-known "1Feex" wallet. This address currently holds approximately 80,000 Bitcoin, a massive fortune that is widely believed to have been tied to historical hacks and thefts from the defunct Mt. Gox exchange during its turbulent early operational years.
In the case of the 1Feex wallet, the attackers constructed a customized on-chain message directing unsuspecting or curious observers to a fraudulent, newly minted website explicitly designed to impersonate the long-defunct Wall Street financial institution Salomon Brothers.
Fake Legal Claims and Coercive Tactics
Upon visiting the fraudulent website, targets are confronted with a fabricated legal notice asserting that the targeted cryptocurrency wallet is officially considered "lost or abandoned." The site then employs high-pressure tactics, inviting supposed rightful owners to step forward and prove their claims.
To accomplish this verification, the site instructs victims to either sign an on-chain message utilizing their private key—which could potentially expose them to immediate asset theft—or submit sensitive personal documentation through an embedded web contact form. To instill a sense of urgency and panic, the notice includes a strict deadline, warning that if no valid claim or response is received by October 5, the wallet will be permanently deemed legally abandoned under fictitious legal frameworks.
BitMEX Research thoroughly investigated the claims made on the platform and quickly established that the website possesses no credible operational or historical link to the real Salomon Brothers or its former leadership team. While the fraudulent site attempts to build a veneer of legitimacy by displaying a list of real individuals who genuinely worked at Salomon Brothers back in the 1980s, the research firm confirmed that none of these former professionals have any association whatsoever with this new and spurious entity.
Furthermore, analysts noted that the stylistic approach and operational blueprint of the campaign bear striking similarities to previous controversies. Specifically, the strategy is reminiscent of earlier disputes associated with controversial figures such as Calvin Ayre, who previously funded complex legal actions involving the exact same historical Bitcoin address.
BitMEX Research detailed the deceptive nature of the site’s associations in their public findings, noting that the web page featuring an advisory board comprised of real historical figures from the financial sector is entirely a facade. The firm cautioned that these former employees have no connection to the modern scam operation utilizing the firm’s historic name.
Community Warnings and the Rising Tide of Crypto Fraud
As news of the campaign spread across cryptocurrency forums and social media networks, community members and blockchain sleuths quickly weighed in with their own observations. Several experienced participants pointed out fundamental flaws in the scammers’ premise, noting that a legitimate wallet owner wishing to prove activity or ownership would simply need to move a negligible amount of Bitcoin from the address to a new location, rather than attempting to transfer a full balance or surrender private keys and sensitive data.
These observations have led security professionals to suspect that the campaign is merely one component of a much broader, highly coordinated social engineering scam effort. Such campaigns are specifically engineered to harvest sensitive personal information, credentials, or private keys under the false pretext of formal legal compliance and regulatory necessity.
Security experts have reiterated strong warnings across the digital asset space, emphasizing that users, particularly those managing legacy or dormant assets, should completely avoid interacting with the suspicious contact form, refrain from signing arbitrary messages linked to the site, and never disclose personal or financial details.
The emergence of these inventive social engineering tactics underscores the steadily growing complexity and persistence of cryptocurrency-related fraud. Malicious actors continue to evolve their methodologies, moving beyond simple phishing emails to leverage native blockchain features and sophisticated corporate impersonation.
This trend mirrors broader security challenges facing the digital economy. Data tracking the broader industry landscape indicates that in the first half of 2025 alone, hackers and malicious syndicates successfully stole over $2.1 billion across 75 separate security incidents. This figure represents a troubling 10% increase in total stolen funds compared to the same period in the previous year, highlighting an urgent need for heightened vigilance among both retail participants and institutional holders alike.
Asro 
Layla Zulfa 
Muslim