By Nana 
Analysts at BitMEX Research have raised a critical security alarm regarding a sophisticated new scam campaign targeting early Bitcoin holders, with a particular focus on dormant wallets dating back to the formative years of the cryptocurrency, such as 2011. The fraudulent scheme marks a distinct evolution in crypto-related social engineering tactics, combining on-chain data manipulation with elaborate, deceptive legal pretexts designed to trick unsuspecting or inactive asset holders into compromising their private keys or surrendering sensitive personal information.
According to the research firm, the scam exploits long-dormant blockchain addresses by injecting false transactions and misleading text messages directly into the ledger. Attackers achieve this by leveraging OP_Return outputs, which are an optional field within Bitcoin transactions capable of carrying arbitrary data. By embedding malicious strings of data into these fields, the perpetrators ensure that anyone monitoring or scanning these historical addresses encounters the fabricated prompts and notices, drawing them deeper into the web of deception.
In one prominent and well-documented case highlighted by the analysts, the scammers focused their efforts on the heavily scrutinized "1Feex" wallet. This particular address holds approximately 80,000 Bitcoin and is widely believed by blockchain sleuths and investigators to contain funds that were stolen during the infamous 2011 security breach of the Mt. Gox exchange. Capitalizing on the historical notoriety and immense value associated with this address, the attackers crafted a specialized message within the blockchain data that links potential victims to a fraudulent, newly minted website designed to impersonate Salomon Brothers, the legendary and defunct Wall Street investment banking firm.
Upon visiting the fraudulent website, targets are met with an official-looking legal notice asserting that the targeted cryptocurrency wallet is considered "lost or abandoned." The site then prompts the supposed rightful owners to step forward and prove their ownership claims. To substantiate these claims, the fraudulent platform instructs users to either sign an on-chain message using their private key—which would instantly grant the malicious actors total control over the funds—or submit detailed personal documentation through a web-based contact form. Adding a heavy sense of manufactured urgency, the notice explicitly states that if no formal response or claim is received by October 5, the wallet will be legally deemed abandoned and seized or redistributed.
Fake Legal Claims and Deceptive Advisory Boards
Following their initial discovery, BitMEX Research conducted a deeper investigation into the background of the website and the entity behind the notices, quickly uncovering a web of falsehoods. The platform warned the crypto community that the website shows absolutely no credible or legitimate link to the historical Salomon Brothers firm or its former leadership network. While the fraudulent operators attempted to build a facade of authenticity by displaying a list of real individuals who genuinely worked at Salomon Brothers back in the 1980s, none of these former professionals have any association whatsoever with this new and spurious entity.
The research firm further noted that the strategic approach utilized in this campaign bears a striking resemblance to earlier, controversial controversies. Specifically, analysts pointed out parallels to past legal maneuvering and public disputes associated with figures such as Calvin Ayre, who previously funded high-profile legal actions involving the exact same Bitcoin address. By wrapping their scheme in the complicated language of corporate history and high-stakes legal disputes, the orchestrators hoped to exploit the confusion surrounding historical asset recovery.
In an official statement addressing the matter, BitMEX Research detailed the disconnect between the website’s claims and reality: "The links between this company and this website are fake. There is a page with an advisory board that contains real people who worked at Salomon Brothers in the 1980s, however, these people seem to have no link to this new spurious entity."
As news of the scam spread across digital asset forums and social media networks, cryptocurrency community members quickly weighed in to debunk the technical and procedural premises of the fake notice. Experienced blockchain users pointed out that even in genuine scenarios involving asset recovery or proof of life for dormant accounts, a legitimate wallet owner would never be required to surrender private keys or fill out arbitrary web contact forms. Instead, standard verification typically involves simple cryptographic signatures or moving a negligible, minuscule amount of Bitcoin to prove active control over the address, rather than exposing full balances or sensitive personal data.
These community observations have reinforced the growing consensus among security experts that the campaign is not a genuine legal proceeding, but rather part of a much broader, highly calculated social engineering effort. Fraudsters are increasingly turning to complex pretexts—ranging from fake regulatory warnings to manufactured legal abandonment claims—to harvest sensitive information and private keys from long-absent cryptocurrency investors who may be out of touch with modern security best practices.
In light of these findings, BitMEX has issued a stern warning emphasizing that users and holders of historical addresses must exercise extreme caution. The firm explicitly advised the public never to interact with the suspicious contact forms, click unverified links found within on-chain transaction data, or provide any personal details or cryptographic signatures in response to these notices.
The emergence of this sophisticated wallet-recovery scam underscores the constantly evolving and increasingly complex nature of fraud within the digital asset ecosystem. Malicious actors continue to innovate, shifting away from simple phishing emails toward deeply integrated, multi-layered attacks that manipulate public blockchain infrastructure itself. This trend aligns with broader industry data tracking the rising tide of illicit activity; in the first half of 2025 alone, hackers and cybercriminals successfully stole over $2.1 billion across 75 separate security incidents, representing a troubling 10% increase compared to the same tracking period in the previous year. As these threats continue to diversify, security analysts maintain that vigilance, skepticism, and strict private key management remain the primary lines of defense for cryptocurrency holders across the globe.
rifanmuazin 
Sagoh 
Asep Darmawan