Mysterious messages on bitcoin point to a possible scam

Some owners of old bitcoin (BTC) addresses have received messages on the bitcoin blockchain that appear to be a scam attempt.

First, blockchain analysts noticed that the recently moved 80,000 BTC, dormant since 2011, had multiple mysterious messages in their addresses. And now, the same messages were sent to an address holding almost 80,000 BTC stolen from the Mt. Gox bitcoin exchange, which went bust in 2014.

"There appears to be an ongoing bitcoin scam occurring. Someone is sending old 2011-era bitcoin addresses with balances, transactions with an OP_Return output," analysts at BitMEX Research said.

The communication on-chain goes through several steps. The first message contains this text: "LEGAL NOTICE: We have taken possession of this wallet and its contents," while the second comes more as an ultimatum: "Not abandoned? Prove it by an on-chain transaction using private key by Sept 30th."

One of the messages sent on the bitcoin blockchain

Then comes a message containing a now inactive link to salomonbros[.]com/owner_notice. While the salomonbros[.]com website that offers financial services can still be reached, according to BitMEX Research, "it should be noted that the website appears illegitimate."

Also, the researchers said that before the notice was removed, it claimed that "this digital wallet appears to be lost or abandoned. Our client has taken constructive possession of it and seeks to determine if there is a bona fide owner," while also containing a web form seeking personal details.

Meanwhile, the final message contains only the numbers "4 8 15 16 23 42," which are associated with the TV series Lost.

"Even more troubling: in Lost, these numbers eventually cause a global catastrophe when their control system fails. A subliminal message about the potential consequences of this exploit?" writes an analysis published by Cyphertux.

According to them, the messages were sent in "perfect coordination," as the first three legal messages were broadcast simultaneously to multiple wallets, while the final artistic signature was selectively sent to only three addresses.

"The uniformity of the targeted wallets and their P2PKH format raises a disturbing question/hypothesis: what if someone had succeeded in exploiting a cryptographic weakness? (unlikely)," Cyphertux said.

P2PKH refers to Pay To Public Key Hash, which is a legacy script pattern used to transfer BTC.

In either case, while there are no clear answers about who is sending the messages and why, some commenters online speculate that it might be a "hack with legal cover," an attempt to launder funds, or part of a more sophisticated game.