Mt. Gox Hacker Wallet Flooded with Spoof Transactions—Is Someone Playing Games?

Someone’s messing with the Mt. Gox hacker’s wallet—and it’s not the feds.

Fake transactions are piling up in the infamous Bitcoin wallet linked to the 2014 exchange collapse. Is it a prankster, a vigilante, or just another crypto clown making noise?

Meanwhile, traditional finance bros are still trying to figure out how to short it.

Mt. Gox hacker wallet receives spoof transactions

One of the most targeted wallets belongs to the Mt. Gox Hacker, containing 79.95K BTC valued at over $8B. The wallet was last dusted on July 5, 2025, though it received additional tracing transactions or messages in the past. None of the coins in the wallet has been moved. 

One of the transactions from July 3, 2025, contained an op_return message pointing to an ‘owner notice’. The notice, when decoded, called the wallet holder to visit a site claiming to be linked to Salomon Brothers, a known Wall Street firm that was acquired by Citigroup in 2003 and no longer exists as a legal entity. 

Since July 3, the spoof site has been taken down. But before that, the message suggested that a third party attempted to claim possession of the wallet in legal terms. The claim via op_return, sent to the wallet, resembled the attempts of Calvin Ayre to prove ownership of old wallets. 

Scammers gather data or attempt pseudo-legal claims

Some of the links sent in the op_return message attempt to gather personal data or connect a wallet to a real identity. 

So far, legal claims against inactive wallets have been unsuccessful, as BTC ownership hinges on holding private keys. Neither miners nor developers can claw back the BTC from idle wallets, despite claims of ownership. 

However, knowing the identity of old whales, if extracted through phishing, could lead to other types of attacks, such as kidnapping or attempting to steal private keys. 

Interest in old wallets increased after a whale with coins from 2011 moved 80,000 BTC to new addresses in a single day. 

Some of the initial whale wallets immediately received dust transactions containing spoofed op_return messages with pseudo-legal language.

One of the messages read ‘LEGAL NOTICE: We have taken possession of this wallet and its contents’. However, the actual wallet was emptied, and the coins were controlled by a new owner, with no further need for a legal claim. 

The cluster of dormant whale wallets also revealed that op_return attacks came in coordinated waves, potentially linked to a handful of bad actors making attempts to gather data or deploy other phishing tools. 

Attacks via op_return messages may stop after a Bitcoin upgrade, as there are proposals to limit the data threshold to just 80 bytes, not allowing even short messages.

Cryptopolitan Academy: Tired of market swings? Learn how DeFi can help you build steady passive income. Register Now