IRS Fake Digital Asset Compliance Portal Letter Campaign — 2026
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·boVEv7…1PpqSummary
A fraud campaign active as of late July 2026 in which unknown threat actors mail physically printed letters impersonating the IRS, instructing cryptocurrency holders to enroll in a nonexistent 'Digital Asset Compliance Portal' via an embedded QR code. The IRS Criminal Investigation division publicly confirmed on July 30, 2026 that it does not operate any such portal and did not send the letters. Infrastructure linked to the campaign was registered through a Hong Kong-based registrar and hosted on Romanian servers previously associated with financial phishing attacks.
Connected Entities
4 entities · 60 linked investigations- IRS Fake Digital Asset Compliance Portal Letter Campaign — 2026→mentioned with→Coinbase(70%)
- IRS Fake Digital Asset Compliance Portal Letter Campaign — 2026→mentioned with→Binance(60%)
- IRS Fake Digital Asset Compliance Portal Letter Campaign — 2026→mentioned with→Trezor(60%)
Timeline(6 events)
28 July 2026
Coinbase and threat intelligence firm DarkTower release a consumer alert identifying the fake IRS 'Digital Asset Compliance Portal' letter campaign after a customer report triggered investigation.
Crypto Briefing30 July 2026
IRS Criminal Investigation issues formal public warning, confirming no 'Digital Asset Compliance Portal' exists and that the letters are fraudulent. IRS-CI Chief Jarod Koopman issues statement.
Bloomberg31 July 2026
Multiple outlets including Accounting Today, CryptoTimes, and The Star (Malaysia) report on the IRS-CI warning. IRSnews official X account posts alert.
Accounting Today3 August 2026
CPA Practice Advisor publishes detailed breakdown of campaign mechanics and victim guidance, citing IRS-CI and DarkTower findings.
CPA Practice Advisor4 August 2026
Help Net Security and Bitdefender publish extended technical analyses of the multi-stage attack flow and phishing infrastructure.
Help Net Security7 August 2026
No arrests or law enforcement actions against campaign operators publicly announced as of this date. Investigation is ongoing per IRS-CI guidance.
AVOID.NET research compilationDecision Log
- slot 443518208 · hash HNaZyAvRYHuU7PRp1XTZn6vG6xSVeZhSsX6n9KUTihEV
- slot 443518180 · hash Aed2o6V23z6DNg8ee5aHZuumJ65DE6jBTnH2SZVJpinW
- slot 443504705 · hash 5pZeeTLbJJ1KNfppZrTQvpf9LxKHDvEq96FS1YfXFaDi
This investigation is cryptographically anchored to the Solana blockchain (3 decisions). 11 of 15 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/7/2026, 12:30:07 PM
last updated: 8/25/2026, 10:57:01 PM
5 viewsavoid.net — verified advice for a post-truth world