By Muslim 
Analysts at BitMEX Research have raised the alarm regarding a sophisticated new scam targeting early Bitcoin holders, with a particular focus on dormant wallets dating back to the foundational eras of the cryptocurrency, including 2011. The campaign represents an evolving threat vector within the digital asset ecosystem, leveraging on-chain data manipulation and elaborate social engineering to deceive unsuspecting holders or individuals associated with high-profile historical blockchain addresses.
According to the research firm, the malicious campaign exploits long-dormant addresses by injecting false transactions and misleading messages directly into the blockchain using OP_Return outputs. The OP_Return field is an optional part of a Bitcoin transaction designed to allow developers and users to embed a small amount of arbitrary data into the blockchain ledger. While historically used for digital asset protocols, proof-of-existence records, and descriptive metadata, bad actors have increasingly found ways to leverage this mechanism to push fraudulent notifications straight to blockchain explorers and wallet interfaces that display incoming transaction metadata.
In one of the most prominent documented cases of this campaign, the attackers focused their efforts on the well-known "1Feex" wallet address. This specific address holds approximately 80,000 Bitcoin, a massive fortune that is widely believed by the cryptocurrency community and blockchain investigators to have been stolen during the infamous 2011 hack of the Mt. Gox exchange, which was once the dominant marketplace for Bitcoin trading.
To execute the ruse, the attackers crafted a specialized transaction featuring an OP_Return message that directs prospective victims to a fraudulent website. This malicious web platform has been designed to meticulously impersonate the defunct investment bank and brokerage firm Salomon Brothers. By adopting the branding and professional aesthetics of a legacy Wall Street institution, the scammers attempt to establish an air of corporate and legal authority to lower the guard of anyone who investigates the address.
Fake Legal Claims and Coercion Tactics
Once a visitor navigates to the fraudulent website, they are presented with a fabricated legal notice. The notice asserts that the targeted Bitcoin wallet is considered legally "lost or abandoned." To add urgency and pressure to the interaction, the site invites supposed rightful owners or claimants to step forward and prove their ownership.
The fraudulent instructions demand that victims either sign an on-chain message utilizing the private key associated with the ancient wallet or submit sensitive personal documentation through an embedded web contact form. To force quick compliance, the notice includes a strict deadline, warning that if no valid ownership claim or response is received by October 5, the wallet will be permanently deemed legally abandoned under the purported terms of the notice.
BitMEX Research has strongly cautioned the cryptocurrency community that the website shows no credible, legitimate link to the real Salomon Brothers or its former leadership team. A deeper inspection of the fraudulent web page reveals a list of real individuals who historically worked at Salomon Brothers during the 1980s, displayed under an advisory board or team section. However, investigators have confirmed that these real-world professionals have no association whatsoever with this new and spurious entity.
Industry observers have noted that the operational approach bears strong thematic similarities to previous controversies. Some community members have pointed out stylistic and strategic overlaps with earlier campaigns associated with controversial figures such as Calvin Ayre, who previously funded legal actions and public disputes involving the exact same historical Bitcoin address.
BitMEX Research elaborated on the deceptive nature of the web platform, stating that the links between the company and the website are completely fabricated. The firm highlighted the presence of the advisory board containing real former Salomon Brothers employees, reiterating that these individuals appear to have no connection to the fraudulent operation.
Experienced cryptocurrency community members have also weighed in on the mechanics of the scam, pointing out glaring red flags in the attackers’ methodology. Security-conscious observers noted that legitimate wallet owners seeking to prove activity on a dormant address would typically execute a simple, low-risk transaction, such as moving a negligible amount of Bitcoin to a fresh address under their control, rather than transferring a full balance or handing over cryptographic proof and private keys to an unverified web entity.
This technical impracticality has led security researchers and analysts to suspect that the campaign is merely part of a broader social engineering effort. Rather than actually expecting to trick the original, historical owner of the Mt. Gox-linked funds, the architects of the scheme are likely casting a wide net to harvest sensitive personal information, credentials, or administrative details under a convincing legal pretext.
Security analysts emphasize that users should exercise extreme caution, advising anyone who encounters similar messages not to interact with the provided contact forms, click suspicious links, or disclose personal and financial details.
The emergence of these specialized social engineering and data-harvesting campaigns highlights the growing complexity and persistent danger of crypto-related fraud. The broader threat landscape continues to expand as bad actors refine their tactics. In the first half of 2025 alone, hackers and cybercriminal syndicates successfully stole over $2.1 billion across 75 separate security incidents, marking a concerning 10% increase in total losses compared to the same period in the previous year. As on-chain analytics improve and law enforcement agencies ramp up tracking capabilities, fraudsters continue to adapt, turning to psychological manipulation and fake legal frameworks to target the weakest links in the digital asset ecosystem.
Lina Hope 
Asro 
Layla Zulfa