Scam targets dormant Bitcoin wallets with fake legal notice

According to analysts at BitMEX Research, the malicious campaign specifically focuses on long-dormant Bitcoin wallets, with a heavy emphasis on addresses created as early as 2011. The attackers are deploying deceptive tactics that exploit fundamental features of the Bitcoin network to inject false transactions and misleading messages directly into targeted accounts. By leveraging the OP_Return output—an optional field within Bitcoin transactions capable of carrying arbitrary data—the scammers are able to attach custom text messages that appear on-chain, lending a false sense of authenticity to their communications.

In one prominent and well-documented case highlighted by the researchers, the perpetrators trained their sights on the heavily scrutinized "1Feex" wallet. This particular address holds approximately 80,000 Bitcoin, a massive sum that is widely believed by blockchain sleuths and industry experts to have been stolen during the infamous 2011 security breach of the Mt. Gox exchange, which was once the world’s dominant Bitcoin trading platform.

Rather than attempting a direct cryptographic compromise of the dormant private keys, the attackers utilized the OP_Return data injection method to attach a message to the wallet. This message directs anyone monitoring or inspecting the address to a fraudulent, newly minted website designed to impersonate the defunct historical financial institution Salomon Brothers.

Upon visiting the fraudulent domain, victims are greeted by what appears to be a formal legal notice. The site asserts that the high-value wallet is legally classified as "lost or abandoned." To create an air of legitimacy, the platform invites supposed rightful owners of the historical address to step forward and prove their claim. The instructions on the site demand that individuals either sign an on-chain message utilizing the original private key associated with the address or submit sensitive personal documentation through a web-based contact form. To instill a sense of urgency, the fake legal notice dictates that if no valid claim or response is received by October 5, the wallet will officially and permanently be deemed legally abandoned, creating a high-pressure environment intended to bypass the cautious instincts of potential victims.

Fake legal claims and manufactured corporate ties

Following the initial discovery of the campaign, BitMEX Research conducted a deeper investigation into the background of the website and the purported legal entity behind the notice. The analysis revealed that the platform shows absolutely no credible or verifiable link to the real, historical Salomon Brothers or its former leadership executives.

While the fraudulent website attempts to establish credibility by publicly displaying a list of real individuals who genuinely worked at the prestigious investment bank during the 1980s, none of those former professionals appear to have any actual association with this newly formed and spurious entity. Security analysts noted that the overall structure and presentation of the approach bear striking similarities to previous, controversial legal maneuvers and campaigns associated with polarizing figures like Calvin Ayre, who previously funded legal action involving the exact same historical Bitcoin address.

BitMEX Research formally highlighted the deceptive nature of these associations, stating that the links between the shell company and the website are entirely fabricated. The inclusion of an advisory board featuring real former employees of Salomon Brothers is a calculated maneuver designed to deceive casual observers into believing the legal notice carries institutional weight, even though those individuals have no connection to the current scheme.

The cryptocurrency community has also weighed in heavily on the matter across various public forums and social media channels. Experienced Bitcoin users and network analysts quickly pointed out glaring flaws in the scam’s premise, noting that a legitimate wallet owner wishing to prove activity or ownership would simply need to move a small, negligible amount of Bitcoin from the address rather than transferring the full balance or handing over control.

These glaring logical inconsistencies have led a significant portion of the security community to conclude that the campaign is not a genuine legal proceeding, but rather part of a broader, highly targeted social engineering effort. The ultimate objective of the campaign appears to be the gathering of sensitive personal information and private key data under the guise of regulatory compliance and legal oversight.

In light of these findings, BitMEX Research and other cybersecurity experts have issued strict warnings advising users, early adopters, and asset managers never to interact with the suspicious contact forms, click the unverified links, or provide any personal or cryptographic details to the fraudulent entity.

The escalating threat of sophisticated crypto fraud

The emergence of these elaborate, history-targeting scams underscores the rapidly growing complexity and professionalization of crypto-related fraud within the digital asset ecosystem. Malicious actors are increasingly moving beyond simple phishing emails and fake exchange applications, opting instead for nuanced campaigns that manipulate on-chain data structures and exploit the public nature of blockchain ledgers to target legacy holders who may be out of touch with modern security protocols.

This campaign arrives against a backdrop of escalating financial losses across the broader digital asset sector. Data compiled from various security firms and blockchain analytics providers indicates that in the first half of 2025 alone, hackers and cybercriminal syndicates successfully stole over $2.1 billion across 75 separate security incidents. This represents a substantial 10% increase in total stolen funds compared to the figures recorded during the exact same period in the previous year, driven largely by aggressive, state-backed hacking groups and increasingly sophisticated social engineering syndicates.

As the tactics employed by threat actors continue to evolve, blockchain security analysts stress that vigilance remains the primary defense for long-term cryptocurrency holders. With billions of dollars in dormant wealth sitting in early-era addresses, campaigns targeting these historical wallets are expected to persist, highlighting the critical need for heightened awareness across the entire digital asset community.