By Raul Delapena Setiawan 
Analysts at BitMEX Research have raised a serious security alarm regarding an emerging cryptocurrency scam specifically targeting early Bitcoin holders, with a primary focus on legacy wallets dating back to the foundational years of the asset, notably 2011.
According to the intelligence gathered by the research firm, the sophisticated campaign exploits long-dormant blockchain addresses by injecting deceptive transactions and misleading messages directly onto the ledger. This is accomplished using OP_Return outputs, which are an optional field within Bitcoin transactions specifically designed to carry arbitrary pieces of data. By leveraging this on-chain mechanism, the perpetrators are able to broadcast their fraudulent narratives directly to anyone monitoring these historic addresses through block explorers or dedicated wallet tracking tools.
In one of the most prominent documented cases of this campaign, the attackers targeted the widely recognized "1Feex" wallet. This specific address holds approximately 80,000 Bitcoins that are historically believed to have been stolen during the infamous security breach of the Mt. Gox exchange years ago. Crafting a targeted lure specifically for this high-profile dormant address, the malicious actors embedded a message that directs potential victims or curious observers to a fraudulent website meticulously designed to impersonate Salomon Brothers, a legendary Wall Street firm that has long since ceased traditional operations.
The fake website presents visitors with an official-looking legal notice claiming that the targeted wallet is legally classified as "lost or abandoned." To add an extra layer of psychological pressure and false urgency, the notice invites the supposed owners to step forward and prove their rightful claim. The fraudulent platform instructs individuals to either sign an on-chain message utilizing the private key associated with the address or submit sensitive personal documentation through a rudimentary web-based contact form. To force compliance and panic, the notice explicitly states that if no official response or verification is received by October 5, the wallet will be permanently deemed legally abandoned under fictitious statutory rules.
Fake legal claims and impersonation tactics
Delving deeper into the mechanics of the scheme, BitMEX Research warned that the fraudulent website shows zero credible links or affiliations to the real Salomon Brothers institution or its historical leadership structure. While the site attempts to manufacture an illusion of legitimacy by displaying a list of real individuals who genuinely worked at the historic firm during the 1980s, none of these former professionals appear to have any connection whatsoever to this newly minted and spurious entity.
The platform compared this deceptive approach to an earlier, highly publicized scam associated with controversial industry figures such as Calvin Ayre, who had previously funded legal action involving the exact same Bitcoin address. This historical overlap suggests that high-value dormant addresses are routinely monitored by bad actors looking to capitalize on legal ambiguity, forgotten keys, or high-stakes civil disputes.
BitMEX Research highlighted the deceptive nature of the board listings, stating that the links between the shell company and the website are entirely fabricated. The firm noted that while the page features an advisory board containing real people who worked at Salomon Brothers decades ago, these individuals are completely unrelated to the current fraudulent operation.
Members of the wider cryptocurrency community have also weighed in on the mechanics of the scam, pointing out glaring logical flaws in the attackers’ premise. Industry commentators noted that if a legitimate, original wallet owner ever needed to prove activity or ownership of an ancient address, they could simply execute a minor transaction by moving a trivial amount of Bitcoin rather than transferring the full balance or exposing private keys and personal identity documents to an unverified third-party entity.
This glaring discrepancy has led many security researchers and community analysts to suspect that the entire campaign is part of a broader, highly coordinated social engineering scam effort. The ultimate objective appears to be gathering sensitive personal information, private keys, or credentials under a heavily disguised legal pretext, which can then be weaponized in subsequent attacks.
Emphasizing the severity of the threat, BitMEX issued a strict warning advising all users and asset holders never to interact with the suspicious contact form, click unverified links, or provide any personal details or cryptographic signatures in response to these on-chain notifications.
The emergence of these inventive social engineering vectors illustrates the continuously growing complexity, persistence, and ingenuity of crypto-related fraud. The landscape of digital asset security remains fraught with danger as malicious actors constantly develop new methods to exploit human psychology and technical oversights. According to recent industry reports, the broader threat environment continues to escalate rapidly; in the first half of 2025 alone, hackers and malicious syndicates successfully stole over $2.1 billion across 75 separate security incidents, representing a concerning 10% increase in total losses compared to the exact same period in the previous year.
Asro 
Layla Zulfa 
Muslim