A historic Bitcoin address linked to the Mt. Gox exchange hack has become the focus of a phishing campaign exploiting the OP_RETURN feature on the blockchain.
The wallet, identified as 1FeexV6bAHb8ybZjqQMjJrcCrHGW9sb6uF, holds just under 80,000 BTC, valued at approximately $8.7 billion at current market prices.
The attack involves using the OP_RETURN code to attach data to transactions, which, in this case, is being used to deliver scam messages. These messages often include links and bait designed to deceive the wallet’s owner into visiting a fake website that mimics the branding of Salomon Brothers, a long-defunct Wall Street firm.
Screenshots from Mempool show the embedded messages appearing in various formats. Once visited, the phishing site presents a notice claiming the wallet is “lost or abandoned” and invites the user to submit verification through a web form.
According to BitMEX, this is a clear attempt to extract personal information by impersonating a reputable financial institution.
Despite the use of the Salomon Brothers name and branding, the original investment bank was dissolved when it merged with Citicorp to form Citigroup decades ago.
Some former employees attempted to resurrect the name under “Salomon Encore,” using the salomonencore[.]com domain, which now redirects to salomonbros[.]com. However, there is no public evidence linking the phishing page at /owner_notice on salomonbros[.]com to any official entity.
Security researchers believe the fraudulent webpage is designed purely to harvest sensitive information under the guise of asset recovery. The tactic preys on the high-value nature of dormant wallets and aims to trick holders into revealing their credentials.
The incident harks back to the infamous Mt. Gox collapse, where over 850,000 BTC went missing due to alleged hacking. Approximately 200,000 BTC were eventually recovered years later. The current phishing attempt reinforces the continued risks faced by long-term crypto holders, even years after high-profile hacks.
