Weirdest Bitcoin Heist Yet? OP_RETURN Targets Dormant Wallets

An obscure firm using the storied “Salomon Brothers” name has ignited one of Bitcoin’s strangest ownership fights to date: a mass “dusting” campaign that blasted tens of thousands of legacy wallets with on-chain “legal notices” embedded in OP_RETURN messages. In a detailed forensic study, Galaxy Research links the messages to a coordinated attempt that may be laying groundwork for abandoned-property claims—though it remains unclear how any claimant could ever take control of coins without the private keys.

Bitcoin Dust Attack Sparks Legal Chaos

According to Galaxy’s analysis, an unknown, sophisticated actor sent 41,523 OP_RETURN messages from 3,738 sender addresses to 39,423 recipient addresses that collectively held about 2.334 million BTC when targeted. The vast majority—98.82%—were legacy P2PKH addresses with very long inactivity, averaging roughly 2,171 days (~5.95 years).

The campaign rolled out in waves over the summer: test transactions in late June with no links or “Salomon” references, followed in July and August by messages carrying all-caps “LEGAL NOTICE” language and URLs pointing to Salomon Brothers’ website. Early operational hiccups—like an initial broken URL—were later corrected as the sender iterated through a “test → blast → monitor → adjust” loop.

The notices directed recipients to a page asserting that the targeted wallet “appears to be lost or abandoned,” and that a Salomon client “has taken constructive possession of it.” The page gives owners ninety days to prove control—either by moving funds on-chain or by submitting documentation—warning that “the lack of a response may be provided to a court as evidence of the relinquishment of all rights, title and interest.” As of Friday, October 10, 2025 (Europe/Berlin), the page states that responses must come “before October 10, 2025.”

“Constructive possession,” as defined by Cornell Law’s Legal Information Institute, refers to legal possession without direct physical control—“for example, someone with keys to a safe deposit box may have constructive possession to the contents of that box.” Applied to bearer-style digital assets, the analogy is provocative: on Bitcoin, control is cryptographic, not custodial, and “keys” are literally the ability to sign. Establishing constructive possession without a private key is, at minimum, legally novel.

Galaxy’s researchers stress there is no evidence the episode reveals a Bitcoin protocol flaw or a private-key compromise. In fact, most of the targeted scripts (legacy P2PKH) are less exposed to certain hypothetical attack classes than other address types. Still, the scale and method—paired with explicit deadlines and relinquishment language—suggest the organizer could attempt legal action in jurisdictions with unclaimed-property statutes that contemplate digital assets.

“Given the OP_RETURN campaign’s scale, the messages’ contents, and the notices they linked to, a plausible interpretation is that whoever is behind them may try to wage legal claims on unresponsive wallets,” Galaxy writes, while cautioning that “the legal viability and possible reach” are “questionable.”

The campaign also coincided with renewed on-chain movement from at least one long-silent whale. Shortly after a tranche of messages drew attention in early July, a wallet associated with an early holder moved roughly 80,000 BTC, fueling speculation that the dusting acted as a wake-up call for dormant addresses. Whether cause, coincidence, or opportunistic timing, the episode underscored a truth unique to bearer crypto: proof of life is an on-chain signature away.

Salomon’s public posture, captured across its website, frames the effort as a compliance exercise “meant only for the wallet owner,” insisting the client “is not a hacker and is not phishing.” But the notice also asserts that, after the 90-day window, the “digital wallets and their contents will be considered to be confirmed as abandoned,” and warns against any “trespass” without the client’s authorization—language likely to alarm Bitcoiners who view private keys as the sole arbiter of control.

What happens next hinges on courts more than code. Abandoned-property law in the US varies by state, and even where statutes recognize virtual currency, translating a court order into on-chain control is non-trivial. Without the keys, a claimant cannot sign a transaction; without a cooperative custodian or intermediary, there is no off-chain lever to pull. Galaxy’s bottom line reflects that tension: the gambit is sophisticated and not purely performative, but any attempt to convert “constructive possession” into spendable BTC would face profound practical and legal hurdles.

For now, the dust has settled into an uneasy signal. The campaign demonstrates that OP_RETURN can carry more than memes—it can deliver pseudo-legal processes at blockchain scale. Whether that message ever amounts to more than noise will test the boundaries between on-chain facts and off-chain claims, and whether courts will try to bridge a gap that cryptography, by design, made very wide.

At press time, Bitcoin traded at $121,614.