By Asep Darmawan 
Analysts at BitMEX Research have raised a critical security alarm regarding a sophisticated new scam campaign specifically targeting early Bitcoin holders, with a primary focus on wallets dating back to the foundational years of the cryptocurrency, particularly 2011. The fraudulent scheme appears to exploit long-dormant digital addresses by injecting false transactions and misleading messages directly onto the blockchain, utilizing the OP_Return output—an optional field in Bitcoin transactions capable of carrying arbitrary data.
According to the firm’s findings, the attackers have utilized this vector to target high-profile, dormant assets. In one heavily documented case, the scammers aimed their sights at the well-known "1Feex" wallet. This specific address holds approximately 80,000 Bitcoin, which are widely believed to have been stolen during the historic 2011 hack of the Mt. Gox exchange.
The attackers constructed a deceptive message within the transaction data that directs unsuspecting recipients or curious onlookers to a fraudulent website meticulously designed to impersonate the defunct Wall Street firm Salomon Brothers. Once visitors navigate to the fake portal, they are greeted by a simulated legal notice claiming that the targeted wallet is considered "lost or abandoned."
The fraudulent platform then invites supposed owners to verify their claim and reclaim the vast digital fortune by performing a specific action: signing an on-chain message using their private key or submitting sensitive personal documentation through a web-based contact form. To create a strong sense of urgency and panic, the notice explicitly states that if no valid response or claim is received by October 5, the wallet will be officially and legally deemed abandoned under false pretenses.
Fake Legal Claims and Impersonation Tactics
Following the discovery of the fraudulent portal, BitMEX Research conducted a preliminary investigation and warned that the website bears no credible connection to the real Salomon Brothers or its former leadership team. While the fraudulent site attempts to build a facade of legitimacy by displaying a public list of real individuals who genuinely worked at the prestigious firm during the 1980s, none of those individuals appear to have any association with this new and spurious entity.
Furthermore, analysts noted that the operational approach of this campaign bears a striking resemblance to earlier, controversial controversies. Specifically, observers pointed out thematic parallels to past disputes involving public figures like Calvin Ayre, who previously funded legal actions surrounding the exact same Bitcoin address. However, this new digital incarnation represents a distinct, localized social engineering threat aimed squarely at extracting credentials or private keys.
BitMEX Research detailed the deception in a public statement, noting that the web of affiliations promoted on the portal is entirely fabricated. "The links between this company and this website are fake," the firm stated. "There is a page with an ‘advisory board’ that contains real people who worked at Salomon Brothers in the 1980s, however, these people seem to have no link to this new spurious entity."
As news of the campaign spread across blockchain intelligence circles, cryptocurrency community members quickly weighed in with technical analysis. Experienced operators noted that a legitimate wallet owner attempting to prove current activity or control over an ancient address would never need to interact with a third-party legal form; rather, they could simply move a negligible amount of Bitcoin to a fresh address to cryptographically prove activity while safeguarding their primary balance.
This glaring discrepancy has led security experts and community sleuths to suspect that the entire campaign is part of a broader, highly targeted social engineering effort. Rather than possessing the private keys required to actually seize the dormant funds, the perpetrators are relying on psychological manipulation to trick asset holders, their estates, or naive observers into surrendering sensitive information under the guise of legal compliance.
In light of these findings, BitMEX and other industry security researchers have emphasized that users, asset administrators, and onlookers must not interact with the fraudulent contact form, attempt to sign arbitrary messages linked to the scam, or provide any personal details to the operators behind the portal.
The sudden emergence of these complex legal-themed campaigns highlights the rapidly evolving landscape of crypto-related fraud and the escalating ingenuity of malicious actors. As the broader digital asset economy matures, threat actors continue to deploy increasingly elaborate psychological vectors to bypass technological safeguards. This environment of heightened risk is reflected in broader industry data; in the first half of 2025 alone, hackers and malicious groups successfully stole over $2.1 billion across 75 separate security incidents, marking a 10% increase in total losses compared to the same period in the previous year.
Nana Wu 
Basiran 
Laily UPN