New Scam Targets Dormant Bitcoin Wallets with Fake Legal Notices and Bogus Salomon Brothers Claims

Analysts at BitMEX Research have raised a critical security alarm regarding an emerging and sophisticated scam campaign targeting early Bitcoin holders, with a primary focus on long-dormant wallets dating back to 2011. This newly documented attack vector exploits ancient addresses by injecting false transactions and misleading data directly onto the blockchain, leveraging technical features inherent to the Bitcoin network to lure unsuspecting veterans into a carefully constructed trap.

According to the findings shared by BitMEX Research, the malicious actors behind the campaign are utilizing OP_Return outputs—an optional field within Bitcoin transactions capable of carrying arbitrary data—to transmit false notifications and direct links to victims. By embedding these messages directly into the public ledger, the perpetrators ensure that anyone monitoring old or historic addresses encounters the deceptive outreach, heightening the illusion of legitimacy and urgency.

In one of the most prominent cases uncovered by researchers, the scammers set their sights on the heavily scrutinized "1Feex" wallet. This well-known historical address currently holds approximately 80,000 Bitcoins, assets that are widely believed to have been stolen during the infamous 2011 security breach of the Mt. Gox exchange. The attackers crafted a specific, malicious on-chain message linked to this address, guiding anyone who investigates the wallet toward a fraudulent website designed to impersonate the defunct financial institution Salomon Brothers.

Upon visiting the deceptive web portal, targets are greeted by a fabricated legal notice proclaiming that the dormant wallet in question is legally classified as "lost or abandoned." The site then prompts supposed owners or claimants to verify their identity and establish ownership. To accomplish this, the platform instructs victims to either sign an on-chain cryptographic message using their private keys or submit sensitive personal documentation through an online web contact form. To force compliance and panic among potential victims, the notice includes a strict deadline, warning that if no legitimate claim or response is received by October 5, the wallet will officially be deemed legally abandoned under the fabricated legal framework.

Fake Legal Claims and Exploited Reputations

As analysts dug deeper into the infrastructure of the fraudulent website, BitMEX confirmed that the platform bears no credible connection whatsoever to the real Salomon Brothers or its historic leadership team. While the operators of the scam attempted to build an aura of authority by displaying a list of real individuals who genuinely worked at the prestigious financial firm during the 1980s, investigators verified that none of these former professionals have any association with this new, spurious entity.

The research platform noted that this deceptive approach bears striking tactical similarities to previous controversies surrounding the same Bitcoin address. Notably, the "1Feex" wallet has previously attracted legal maneuvering and funding from controversial figures such as Calvin Ayre, who financed past legal actions concerning the exact same funds. However, this current campaign appears to diverge from standard legal disputes, shifting into what security experts characterize as a calculated social engineering offensive.

In their published advisory, BitMEX Research detailed the deceptive nature of the front organization, stating that the links between the shell company and the presented website are entirely fabricated. They pointed out that while the site features an advisory board containing legitimate former employees of Salomon Brothers, those individuals appear to have no link whatsoever to the suspicious entity operating the portal.

The broader cryptocurrency community has quickly weighed in on the mechanics of the scam, with seasoned blockchain analysts and developers pointing out fundamental flaws in the attackers’ narrative. Community members noted that a legitimate wallet owner wishing to prove activity or operational control over an ancient address would merely need to move a minor, negligible amount of Bitcoin to establish liveness, rather than transferring a full, massive balance or exposing sensitive private keys and personal data to an unknown third-party website.

This discrepancy has fueled widespread suspicion across the digital asset ecosystem that the campaign is not a genuine legal proceeding, but rather a sophisticated social engineering scam meticulously designed to harvest sensitive personal information, cryptographic credentials, and private keys under the guise of an official legal pretext. Security professionals have reiterated strong warnings across social media and research channels, emphasizing that users and early adopters must avoid interacting with the suspicious contact forms, clicking unverified links, or disclosing any confidential credentials.

The Broader Landscape of Crypto Fraud

The emergence of this targeted campaign against historic Bitcoin addresses highlights the ever-evolving complexity and persistence of cryptocurrency-related fraud. As blockchain analysis tools become more sophisticated, malicious actors are increasingly shifting their focus from broad, indiscriminate phishing attacks toward highly personalized, long-horizon social engineering schemes that target specific high-value cohorts, such as early adopters and holders of dormant wealth.

This incident arrives against a backdrop of escalating financial losses across the digital asset sector. Statistical data covering the broader ecosystem indicates that illicit actors and state-backed hacking groups have intensified their operations significantly. In the first half of the year alone, malicious actors managed to steal over $2.1 billion across approximately 75 separate security incidents and heists. This staggering figure represents a notable 10% increase in total stolen funds compared to the exact same period in the previous year, underscoring an ongoing systemic vulnerability in operational security across both individual holdings and institutional infrastructure.

Security analysts emphasize that as public awareness regarding traditional wallet drainage techniques grows, scammers are expected to continue weaponizing blockchain features—such as OP_Return data injection and historic transaction metadata—to craft increasingly elaborate deceptions. For early Bitcoin holders and long-term investors, maintaining strict operational security, ignoring unsolicited legal notices found on-chain, and verifying any claims through trusted, independent legal channels remain vital defenses against sophisticated digital threats.