By rifanmuazin 
Analysts at BitMEX Research have raised a critical security alarm regarding a sophisticated new scam campaign targeting early Bitcoin holders, particularly individuals and entities holding dormant cryptocurrency in wallets dating back to 2011. This emerging threat leverages blockchain mechanics and psychological manipulation, combining on-chain data injection with elaborate social engineering tactics to deceive unsuspecting targets.
According to findings shared by the research firm, the malicious actors behind the scheme are actively exploiting long-dormant Bitcoin addresses by injecting false transactions and misleading messages directly into the blockchain. These payloads are delivered via OP_Return outputs—an optional field within Bitcoin transactions specifically designed to carry arbitrary data without interacting with the network’s UTXO (Unspent Transaction Output) set. By embedding malicious strings and references into these fields, the attackers ensure that anyone monitoring old addresses or examining historical blockchain records encounters their deceptive messaging.
In one of the most prominent documented cases, the scammers set their sights on the highly scrutinized and well-known "1Feex" wallet. This specific address currently holds approximately 80,000 Bitcoins, a massive stash widely believed to be tied to the historic funds stolen during the devastating 2011 cyberattack on the Mt. Gox exchange. Capitalizing on the notoriety and historical significance of the wallet, the attackers crafted a targeted message utilizing the OP_Return mechanism. This message deliberately redirects any curious observers or putative owners to a fraudulent website meticulously designed to impersonate Salomon Brothers, the legendary and now-defunct Wall Street financial institution.
Upon visiting the fraudulent web portal, victims are confronted with a fabricated legal notice asserting that the targeted wallet is officially considered "lost or abandoned." The site employs high-pressure legalistic language to create an illusion of corporate and judicial authority, warning that failure to act swiftly could result in the permanent forfeiture of the digital assets. To substantiate a claim over the dormant funds, the platform invites supposed owners to prove their identity and ownership. The site instructs targets to either sign an on-chain message utilizing the original private key associated with the address or submit sensitive personal documentation through an embedded web contact form. Furthermore, the fake notice establishes an aggressive deadline, stating that if no valid response or claim is received by Oct. 5, the wallet will be legally deemed abandoned and seized.
Fake Legal Claims and Fabricated Corporate Ties
Following their initial discovery, analysts at BitMEX Research conducted a deeper investigation into the fraudulent website and its underlying claims. Their findings revealed that the platform exhibits zero credible connection to the real Salomon Brothers or its former corporate leadership. Although the scammers attempted to build a veneer of legitimacy by displaying a list of real individuals who genuinely worked at the Wall Street firm during the 1980s, none of those former executives appear to have any association whatsoever with this new and spurious entity.
The research team noted that the operational approach and strategic framing of this campaign bear striking similarities to earlier, controversial controversies. Specifically, the tactic echoes previous maneuvers associated with polarizing figures like Calvin Ayre, who famously funded past legal actions and public campaigns involving the exact same 1Feex Bitcoin address. By recycling historical narratives surrounding the infamous Mt. Gox hack and attaching them to a fake corporate identity, the orchestrators of the scam attempt to lend an air of plausibility to an otherwise transparently fraudulent operation.
In a public advisory addressing the situation, BitMEX Research outlined the disconnect between the fraudulent entity and reality, stating that the links established by the website are entirely fabricated. While acknowledging that the perpetrators went to significant lengths to populate an advisory board page with authentic historical figures from the financial sector, the firm reiterated that these individuals have no linkage to the modern shell entity operating the scam.
As news of the campaign spread across digital asset communities, cryptocurrency veterans and blockchain analysts quickly weighed in on the mechanics of the attack. Industry commentators pointed out a glaring logical flaw in the scammers’ premise: a legitimate wallet owner seeking to prove activity and thwart any presumption of abandonment would not need to interact with a sketchy web form or surrender private keys. Instead, a genuine holder could easily move a negligible amount of Bitcoin from the address to a new location, instantly providing undeniable on-chain proof of life and active control without risking their entire balance.
This glaring vulnerability in the scam’s narrative has led widespread security researchers to conclude that the campaign is not a genuine legal dispute, but rather a calculated social engineering effort. The ultimate objective appears to be harvesting sensitive personal information, private keys, or credentials under the guise of compliance and legal verification. BitMEX has strongly urged all users and community members to completely ignore the on-chain prompts, avoid visiting the fraudulent web portal, and refrain from interacting with the contact form or submitting any personal or cryptographic data.
The emergence of this clever yet predatory scheme underscores the escalating complexity and persistence of crypto-related fraud in the modern digital asset landscape. Attackers are increasingly moving beyond simple phishing emails and malicious browser extensions, turning instead to deep on-chain manipulation and historical context to target legacy participants. This persistent wave of financial crime continues to plague the broader ecosystem, compounding an already difficult environment for asset security. According to recent industry data tracking illicit activities, the first half of 2025 alone witnessed hackers and cybercriminals steal over $2.1 billion across 75 distinct security incidents, representing a concerning 10% increase in total losses compared to the same tracking period in 2024. As state-backed syndicates and opportunistic criminal networks continue to refine their methodologies, security advocates emphasize that vigilance and skepticism regarding unsolicited legal notices remain the strongest defense for cryptocurrency holders across all generations of the network.
Sagoh 
Asep Darmawan 
Muslim