Security Alert Issued for Early Bitcoin Holders Amid Sophisticated ‘Lost Wallet’ Scam Campaign

Analysts at BitMEX Research have issued an urgent security warning regarding a sophisticated and deceptive scam campaign targeting early Bitcoin holders, with a particular focus on dormant wallet addresses dating back to the pioneering days of cryptocurrency in 2011.

According to the research firm, the malicious campaign relies on exploiting long-inactive blockchain addresses by systematically injecting false transactions and carefully crafted, misleading messages directly into the ledger. These messages utilize OP_Return outputs, an optional field within Bitcoin transactions specifically designed to carry arbitrary data on-chain. By leveraging this mechanism, the threat actors are attempting to deceive anyone monitoring these historic addresses into believing their funds are subject to legal jeopardy.

In one of the most prominent documented cases uncovered by analysts, the scammers trained their sights on the heavily scrutinized "1Feex" wallet. This infamous address currently holds approximately 80,000 Bitcoin, a staggering sum believed to have been illicitly acquired during the historic 2011 security breach of the Mt. Gox exchange. To execute the scheme, the attackers embedded a custom data message that directs unsuspecting observers to a meticulously crafted, fraudulent website designed to impersonate the long-defunct Wall Street financial institution Salomon Brothers.

Upon visiting the fraudulent web portal, users are confronted with an official-looking legal notice claiming that the targeted wallet is legally classified as "lost or abandoned." The site then prompts supposed rightful owners or claimants to verify their identity and establish ownership. To clear the claim, visitors are instructed to either sign an on-chain cryptographic message utilizing their private keys or submit sensitive personal documentation through an embedded web-based contact form. The notice carries a threatening sense of urgency, warning that if no valid response or claim is registered by October 5, the wallet will be permanently declared legally abandoned and forfeit.

Fake Legal Claims and Fabricated Advisory Boards

Security experts at BitMEX have thoroughly analyzed the fraudulent domain and confirmed that it bears no legitimate operational or structural connection to the real Salomon Brothers or its historic corporate leadership. While the creators of the scam attempted to lend an air of authenticity to the portal by publishing a list of genuine individuals who were historically employed by the financial firm during the 1980s, investigators confirmed these former professionals have absolutely no association with the spurious entity running the campaign.

The research platform noted that this deceptive strategy bears strong thematic similarities to earlier, highly controversial legal maneuvers involving the same historical Bitcoin address, which previously attracted attention from polarizing industry figures like Calvin Ayre, who had funded past legal challenges surrounding the 1Feex funds.

Detailing the deception, BitMEX Research stated that the connections claimed by the fraudulent website are entirely fictitious, noting that the inclusion of an advisory board featuring real-world financial veterans is merely a social engineering tactic intended to manufacture false credibility where none exists.

Cryptocurrency community members and on-chain analysts have also weighed in heavily on the developments, pointing out the glaring logical flaws in the scammers’ demands. Security-minded observers noted that a legitimate wallet owner seeking to prove ongoing activity or control over an address would naturally execute a simple, low-risk transaction—such as moving a minimal fraction of a Bitcoin—rather than surrendering private keys or handing over sensitive personal documents through an unverified web form.

These glaring inconsistencies have led cybersecurity researchers and community watchdogs to conclude that the operation is a calculated social engineering campaign. The primary objective appears to be phishing for sensitive personal information, cryptographic credentials, or private keys under the guise of an official legal proceeding.

BitMEX has strongly cautioned all digital asset holders, particularly veterans of the early cryptocurrency ecosystem, to completely ignore these on-chain data injections and strictly avoid interacting with the fraudulent contact forms or sharing any personal data.

The emergence of these inventive yet dangerous fraudulent vectors highlights the continuously evolving complexity of modern cryptocurrency crime. Cybercriminals are increasingly moving beyond traditional malware and phishing emails, integrating direct on-chain manipulation tactics to target high-value, dormant digital assets. This incident arrives amid a broader wave of digital asset theft. In the first half of 2025 alone, malicious actors and state-backed hacking syndicates successfully stole over $2.1 billion across roughly 75 distinct security incidents, marking a concerning 10% increase in stolen capital compared to the same period in the previous year.