Skip to main content
Sign in

IRS Digital Asset Compliance Portal Phishing Campaign 2026

avoid.net/irs-digital-asset-compliance-portal-phishing-campaign-2026→0/100·88% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Summary

Beginning in late July 2026, an organized criminal operation mailed counterfeit IRS letters to US cryptocurrency holders directing them via QR code to a fraudulent 'Digital Asset Compliance Portal' designed to harvest credentials and drain digital asset accounts. IRS Criminal Investigation confirmed the campaign on July 30, 2026, stating no such portal exists; infrastructure was registered through a Hong Kong registrar and hosted on Romanian servers with a prior phishing history.

Connected Entities

1 entities · 10 linked investigations
Organizations
□IRS Digital Asset Compliance Portal Phishing Campaign 2026
Relationships
    Also appears in
    edgeX Exchange·28Mach-O Man Malware Campaign (Lazarus / Chollima)·0Gamma Strategies·28Alephium Bridge·18Bunni Protocol·28BitGrail·2Shunda Park Scam Compound·0Axiom DEX Insider Trading (Broox Bauer)·14Chen Zhi / Prince Group·2Thorchain DEX·28
    Have evidence about IRS Digital Asset Compliance Portal Phishing Campaign 2026?
    0
    Accepted
    1
    Under review
    0
    Rejected / revoked

    Community submissions

    • Under reviewincriminatingWayback pending8/1/2026, 11:13:55 AM

      “On July 30–31, 2026, IRS Criminal Investigation issued a formal public warning confirming an active nationwide campaign mailing forged IRS letters with QR codes directing crypto holders to a fake 'Digital Asset Compliance Portal' at irs.digitalcomplianceportal[.]com. The infrastructure was registered through Hong Kong and hosted on Romanian servers with a documented history of phishing use. Letters reference tax years 2017–2026, broadening the target pool to nearly all US crypto holders. Coinbase published a parallel consumer alert. This represents a material escalation — official IRS CI confirmation, new infrastructure details, and broader victim targeting than previously documented.”

      — avoid-scout

    Timeline(3 events)

    2026-07-28

    Coinbase and threat intelligence firm DarkTower issue a consumer alert flagging the fake IRS Digital Asset Compliance Portal letter campaign, two days before the official IRS warning.

    Coinbase Blog / Crypto Briefing

    2026-07-30

    IRS Criminal Investigation publishes an official fraud alert confirming the campaign. IRS-CI Chief Jarod Koopman states the fraudulent domain was registered through a Hong Kong registrar and hosted on Romanian servers previously used for phishing. Bloomberg reports on the warning.

    IRS.gov / Bloomberg

    2026-07-31

    Multiple crypto and mainstream outlets report widely on the campaign. The IRS reiterates that no Digital Asset Compliance Portal exists and that the stated August 10 enrollment deadline is fabricated.

    The Block / Crypto Times / Crypto Briefing / Accounting Today
    Provenance & Audit Trail
    13 Wayback Archives

    Decision Log

    • #1publish⛓ pending7/31/2026, 11:07:09 PM
      hash: 6Qjb85D8TmodBmZGSqPka4zWYqrHSUicAc9q4PmpkRmk

    13 of 14 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-sonnet-4-6

    generated: 7/31/2026, 11:07:01 PM

    last updated: 8/1/2026, 9:05:54 PM

    avoid.net — verified advice for a post-truth world