By Nila Kartika Wati 
Analysts at BitMEX Research have raised the alarm regarding a sophisticated new scam campaign targeting early Bitcoin holders, with a particular focus on dormant wallets dating back to the foundational years of the cryptocurrency, notably 2011.
According to the intelligence gathered by the research firm, the malicious scheme exploits long-inactive blockchain addresses by injecting deceptive transactions and misleading operational messages directly into the ledger. Attackers are utilizing OP_Return outputs—an optional field within Bitcoin transactions specifically designed to carry arbitrary data—to communicate with wallet owners or anyone monitoring the blockchain history of these addresses.
In one prominent, well-documented case uncovered by analysts, the perpetrators targeted the notorious "1Feex" wallet. This specific address currently holds approximately 80,000 Bitcoin, which historical blockchain forensics and industry tracking believe were originally stolen during the catastrophic 2011 hack of the early cryptocurrency exchange Mt. Gox.
To execute the fraud, the attackers crafted a specialized blockchain transaction containing a data payload that directs potential victims to a meticulously designed fraudulent website. This rogue domain brazenly impersonates Salomon Brothers, a legendary and defunct Wall Street investment banking firm, lending an aura of institutional legitimacy and corporate authority to the deception.
Upon visiting the fraudulent portal, users are greeted by a forged legal notice declaring that the targeted Bitcoin wallet is considered legally "lost or abandoned." The site then invites supposed rightful owners or claimants to step forward and prove their identity and ownership.
To accomplish this, the instructions on the platform demand that victims either sign an on-chain cryptographic message using their private key or submit sensitive personal documentation through an online contact form hosted on the site. To create a strong sense of urgency and panic, the notice explicitly threatens that if no verified response or ownership claim is received by October 5, the wallet will be permanently and legally designated as abandoned property, ostensibly forfeiting any rights to the digital assets.
Fake Legal Claims and Co-opted Histories
Investigative findings shared by BitMEX Research reveal that the fraudulent website exhibits zero credible connections to the real Salomon Brothers or its historic corporate leadership. While the scammers went to significant lengths to construct a facade of authenticity—including publishing a dedicated page featuring an "advisory board" list comprised of real individuals who genuinely worked at Salomon Brothers during the 1980s—none of these former professionals have any actual association with this newly emerged and spurious entity.
Furthermore, analysts noted that the operational methodology and narrative style of this campaign bear striking similarities to earlier, controversial controversies. Specifically, researchers pointed out thematic parallels to past legal maneuvering associated with figures such as Calvin Ayre, who previously funded separate legal actions involving the exact same 1Feex Bitcoin address.
BitMEX Research detailed these findings in a public statement, emphasizing the deceptive nature of the corporate association: "The links between this company and this website are fake. There is a page with an ‘advisory board’ that contains real people who worked at Salomon Brothers in the 1980s, however, these people seem to have no link to this new spurious entity."
Within the broader cryptocurrency community, experienced blockchain users and security analysts have quickly weighed in on the mechanics of the scam. Many community members pointed out a glaring technical contradiction in the scammers’ premise: a legitimate wallet owner attempting to prove activity or regain control does not need to engage with external legal portals or surrender private keys; they could simply move a negligible amount of Bitcoin from the address to demonstrate active key management and ownership.
This glaring logical flaw has led security researchers and community observers to suspect that the campaign is not genuinely intended to settle legal disputes, but rather functions as a broader, highly targeted social engineering effort. The ultimate objective appears to be harvesting sensitive personal information, private keys, or credential data under the false pretext of a binding legal proceeding.
In light of these discoveries, BitMEX has issued a stern warning to the digital asset community, strongly advising all users—particularly those managing older or dormant holdings—to avoid interacting with the fraudulent contact forms, visiting the linked domains, or providing any personal details whatsoever.
The sudden emergence and evolution of these complex, legally-themed social engineering campaigns highlight the growing sophistication and changing threat vectors facing digital asset holders. Fraudsters are increasingly moving beyond simple phishing emails and fake token giveaways, employing on-chain data injection and institutional impersonation to deceive unsuspecting targets.
This threat landscape aligns with broader industry data tracking a sharp rise in malicious activity across the digital asset ecosystem. In the first half of 2025 alone, hackers and cybercriminal syndicates successfully stole over $2.1 billion across 75 separate security incidents. This staggering figure represents a notable 10% increase in total losses compared to the same operational period in 2024, driven in large part by increasingly aggressive and complex attacks orchestrated by advanced, state-backed hacking groups and specialized cybercrime rings.
Nana 
rifanmuazin 
Sagoh