Weirdest Bitcoin Heist Yet? OP_RETURN Targets Dormant Wallets
An obscure agency utilizing the storied “Salomon Brothers” identify has ignited one among Bitcoin’s strangest possession fights thus far: a mass “dusting” marketing campaign that blasted tens of hundreds of legacy wallets with on-chain “authorized notices” embedded in OP_RETURN messages. In an in depth forensic research, Galaxy Research hyperlinks the messages to a coordinated try that could be laying groundwork for abandoned-property claims—although it stays unclear how any claimant might ever take management of cash with out the non-public keys.
Bitcoin Dust Attack Sparks Legal Chaos
According to Galaxy’s analysis, an unknown, subtle actor despatched 41,523 OP_RETURN messages from 3,738 sender addresses to 39,423 recipient addresses that collectively held about 2.334 million BTC when focused. The overwhelming majority—98.82%—have been legacy P2PKH addresses with very lengthy inactivity, averaging roughly 2,171 days (~5.95 years).
The marketing campaign rolled out in waves over the summer season: check transactions in late June with no hyperlinks or “Salomon” references, adopted in July and August by messages carrying all-caps “LEGAL NOTICE” language and URLs pointing to Salomon Brothers’ web site. Early operational hiccups—like an preliminary damaged URL—have been later corrected because the sender iterated by way of a “check → blast → monitor → regulate” loop.
The notices directed recipients to a web page asserting that the focused pockets “seems to be misplaced or deserted,” and {that a} Salomon consumer “has taken constructive possession of it.” The web page provides homeowners ninety days to show management—both by transferring funds on-chain or by submitting documentation—warning that “the shortage of a response could also be offered to a court docket as proof of the relinquishment of all rights, title and curiosity.” As of Friday, October 10, 2025 (Europe/Berlin), the web page states that responses should come “earlier than October 10, 2025.”
“Constructive possession,” as outlined by Cornell Law’s Legal Information Institute, refers to authorized possession with out direct bodily management—“for instance, somebody with keys to a secure deposit field might have constructive possession to the contents of that field.” Applied to bearer-style digital belongings, the analogy is provocative: on Bitcoin, management is cryptographic, not custodial, and “keys” are actually the power to signal. Establishing constructive possession with out a non-public secret is, at minimal, legally novel.
Galaxy’s researchers stress there is no such thing as a proof the episode reveals a Bitcoin protocol flaw or a private-key compromise. In reality, a lot of the focused scripts (legacy P2PKH) are much less uncovered to sure hypothetical assault lessons than different deal with sorts. Still, the dimensions and methodology—paired with express deadlines and relinquishment language—counsel the organizer might try authorized motion in jurisdictions with unclaimed-property statutes that ponder digital belongings.
“Given the OP_RETURN marketing campaign’s scale, the messages’ contents, and the notices they linked to, a believable interpretation is that whoever is behind them might attempt to wage authorized claims on unresponsive wallets,” Galaxy writes, whereas cautioning that “the authorized viability and attainable attain” are “questionable.”
The marketing campaign additionally coincided with renewed on-chain motion from not less than one long-silent whale. Shortly after a tranche of messages drew consideration in early July, a pockets related to an early holder moved roughly 80,000 BTC, fueling hypothesis that the dusting acted as a wake-up name for dormant addresses. Whether trigger, coincidence, or opportunistic timing, the episode underscored a reality distinctive to bearer crypto: proof of life is an on-chain signature away.
Salomon’s public posture, captured throughout its web site, frames the trouble as a compliance train “meant just for the pockets proprietor,” insisting the consumer “isn’t a hacker and isn’t phishing.” But the discover additionally asserts that, after the 90-day window, the “digital wallets and their contents will probably be thought of to be confirmed as deserted,” and warns towards any “trespass” with out the consumer’s authorization—language more likely to alarm Bitcoiners who view private keys as the only arbiter of management.
What occurs subsequent hinges on courts greater than code. Abandoned-property legislation within the US varies by state, and even the place statutes acknowledge digital forex, translating a court docket order into on-chain management is non-trivial. Without the keys, a claimant can’t signal a transaction; with out a cooperative custodian or middleman, there is no such thing as a off-chain lever to tug. Galaxy’s backside line displays that pressure: the gambit is subtle and never purely performative, however any try and convert “constructive possession” into spendable BTC would face profound sensible and authorized hurdles.
For now, the mud has settled into an uneasy sign. The marketing campaign demonstrates that OP_RETURN can carry greater than memes—it might ship pseudo-legal processes at blockchain scale. Whether that message ever quantities to greater than noise will check the boundaries between on-chain info and off-chain claims, and whether or not courts will attempt to bridge a spot that cryptography, by design, made very broad.
At press time, Bitcoin traded at $121,614.
