Hackers Target Bitcoin Wallet Holding Billions Swiped From Mt. Gox

Hackers appear to be targeting an old Bitcoin address holding over $8 billion in digital coins stolen from collapsed crypto exchange, Mt. Gox.

As first flagged by BitMEX Research, would-be attackers sent the address—1FeexV6bAHb8ybZjqQMjJrcCrHGW9sb6uF—a transaction using OP_RETURN. 

OP_RETURN—which has been controversial among some users—is a way of storing information on Bitcoin’s blockchain. In this case, the transaction sent to the wallet contains text displaying a website address, in an apparent attempt to goad the owner into viewing the page.

The website address leads to a page that reads: “This digital wallet appears to be lost or abandoned. Our client has taken constructive possession of it and is seeks [sic] to determine if there is a bona fide owner.”

And the webpage claims to be a site from Saloman Brothers—a now-closed Wall Street investment bank.

BitMEX said on X that “the website appears illegitimate” and part of an “ongoing Bitcoin scam,” further noting that the website seeks to obtain personal information from the wallet owner. The researchers added that a number of 2011 addresses had been targeted.

The address in question is famous: It first received 79,956 BTC—today worth $8.7 billion—back in 2011. The coins came from hacked Japanese crypto exchange, Mt. Gox, which was shut over a decade ago following a number of hacks. 

Used by the earliest BTC investors, crooks ran away with a total of 850,000 Bitcoin—today worth more than $92.3 billion.

A rehabilitation proposal was approved in 2021 that promised to remunerate about 90% of the assets owed to affected customers. 

Law enforcement managed to claw back just 140,000 Bitcoin to repay creditors. Many of the remaining coins are sitting gathering dust in addresses like the one now being targeted by apparent scammers.