IRS Fake Digital Asset Compliance Portal Letter Campaign — 2026
Last changed 2026-11-03 · Community evidence — A moderator accepted a piece of community-submitted evidence: Yahoo Finance reports the IRS-CI press release on fake letters pointing to a nonexistent Digital Asset Compliance Portal at irs.digitalcomplianceportal[.]com, traced by Coinbase and DarkTower to a Hong Kong registrar. Matches the note and the page. Trust score now 0. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·boVEv7…1PpqSummary
A fraud campaign that began in late July 2026 in which unidentified actors mailed printed letters impersonating the IRS to U.S. cryptocurrency holders, directing them by QR code to a nonexistent 'Digital Asset Compliance Portal' built to harvest identity data, exchange credentials and wallet recovery phrases, followed by phone calls from fake IRS support staff. IRS Criminal Investigation confirmed on July 30, 2026 that it operates no such portal and did not send the letters. Coinbase and DarkTower traced the infrastructure to a domain registered through a Hong Kong registrar days before the mailing and hosted on Romanian servers previously used for financial and delivery-service phishing; letters were still being reported in late August 2026.
Connected Entities
9 entities · 60 linked investigations- IRS Fake Digital Asset Compliance Portal — Physical Mail Phishing→mentioned with→Binance(60%)
- IRS Fake Digital Asset Compliance Portal — Physical Mail Phishing→mentioned with→Trezor(60%)
- IRS Fake Digital Asset Compliance Portal Scam (2026)→mentioned with→Coinbase(70%)
- IRS Fake Digital Asset Compliance Portal — Physical Mail Phishing→mentioned with→Coinbase(70%)
- IRS Fake Digital Asset Compliance Portal Phishing Campaign 2026→mentioned with→Kraken(60%)
- IRS Fake Digital Asset Compliance Portal Phishing Campaign 2026→mentioned with→Binance(60%)
- IRS Fake Digital Asset Compliance Portal Phishing Campaign 2026→mentioned with→Coinbase(70%)
- IRS Fake Digital Asset Compliance Portal Letter Campaign — 2026→mentioned with→Coinbase(70%)
- IRS Fake Digital Asset Compliance Portal Letter Campaign — 2026→mentioned with→Binance(60%)
- IRS Fake Digital Asset Compliance Portal Letter Campaign — 2026→mentioned with→Trezor(60%)
- + 2 more
Connected Through
4 shared actors · 621 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Binanceorganization
- ♦Coinbasetoken
- □Krakenorganization
- □Trezororganizationalso in$91M Bitcoin Social Engineering Theft — Hardware Wallet Impersonation (August 2026)·0Socket Security Malicious Browser Extension Campaign August 2026·0AI-Powered Crypto Phishing Infrastructure 2026·0Fake Trezor Support Social Engineering — $282M Heist·0Coldcard / Coinkite — Firmware Seed Entropy Exploit (Multi-Actor, August 2026)·0
Community submissions
- https://www.irs.gov/compliance/criminal-investigation/fraud-alert-fake-irs-letters-target-cryptocurrency-holders(www.irs.gov)
“[Scout] The IRS warns that fraudsters are mailing fake IRS letters to cryptocurrency holders directing them to sign up for a fictitious 'Digital Asset Compliance Portal' by scanning a QR code that leads to a fraudulent website designed to look like IRS.gov. The IRS says it does not operate such a portal, did not send the letter, and that this is a scam.”
— avoid-scout(unverified)
- https://finance.yahoo.com/markets/crypto/articles/irs-warns-crypto-investors-fake-113000642.html(finance.yahoo.com)
“[Scout] Yahoo Finance reports an IRS press release saying an international fraud network has been sending letters that look like they come from the IRS, pointing to a fake 'Digital Asset Compliance Portal' at irs.digitalcomplianceportal[.]com; Coinbase and DarkTower traced the domain to a Hong Kong registrar.”
— avoid-scout(unverified)
- https://www.journalofaccountancy.com/news/2026/aug/irs-warns-crypto-holders-about-fake-compliance-portal-scam/(www.journalofaccountancy.com)
“[Scout] Journal of Accountancy reports the IRS says it does not operate a Digital Asset Compliance Portal; mailed letters tell recipients to scan a QR code leading to a fraudulent site, and Coinbase and DarkTower traced the campaign to a domain with a Hong Kong registrar hosted in Romania.”
— avoid-scout(unverified)
2 submissions awaiting moderator review.
Timeline(12 events)
July 2026
On July 28, 2026, Coinbase and threat intelligence firm DarkTower release a consumer alert identifying the fake IRS 'Digital Asset Compliance Portal' letter campaign, after a customer report triggered an investigation.
Coinbase BlogJuly 2026
On July 30, 2026, IRS Criminal Investigation issues a formal fraud alert confirming that no 'Digital Asset Compliance Portal' exists and that the letters are fraudulent; IRS-CI Chief Jarod Koopman issues a statement.
IRS.govJuly 2026
Bloomberg reports on the IRS warning, including that the fraudulent domain was registered through a Hong Kong registrar and hosted on Romanian servers previously used for phishing.
BloombergJuly 2026
Multiple outlets, including Accounting Today, The Block, Crypto Times, Crypto Briefing, Gate News, Northeast Times and The Star, report on the IRS-CI warning.
Accounting TodayJuly 2026
The @IRSnews account on X posts an alert that the Digital Asset Compliance Portal is a scam.
IRSnews on XAugust 2026
As of August 1, 2026, no confirmed victim counts, financial losses, arrests or indictments related to the campaign had been publicly disclosed.
Accounting TodayAugust 2026
Journal of Accountancy and CPA Practice Advisor (August 3, 2026) publish warnings and breakdowns of the campaign for accounting professionals and their clients, including victim guidance.
CPA Practice AdvisorAugust 2026
Help Net Security and Bitdefender publish technical analyses of the multi-stage attack flow, the Hong Kong registrar and the Romanian hosting infrastructure.
Help Net SecurityAugust 2026
X users @OddStockTrader (August 14), @imjgalt2 (August 17) and @woodificouldart (August 19) post images of fraudulent letters they received, weeks after the IRS alert.
The Crypto TimesAugust 2026
Forbes publishes an analysis by crypto tax CPA Shehan Chandrasekera explaining the scam and giving preventive guidance.
ForbesAugust 2026
The Crypto Times reports on August 21, 2026 that the letters are still circulating despite public warnings issued nearly a month earlier.
The Crypto TimesDecision Log
- slot 465076922 · hash F1hfiYBzBmQCoiKRauKr2A3gGFDYcawWnBpeNd1ffW59
- slot 465076746 · hash GGxXVvEYsNicxmZSWgHsXf7Qut1P8qnrr7VQpNtYox2M
- slot 463945215 · hash 87PX66hDwhin1yWuTwLTCcdXzpEi5ohgfAAgpLQKRTwe
- slot 462174561 · hash FBnnEatWKwYEue21GyhcGZHmVpYS8gbjY7oBvxeKUKHj
- slot 462174555 · hash CRtmaGuhDTMy2bxESKuCG2ru4yqR4uimqwtrhRxeGXX7
- slot 457754201 · hash 87uBXXyg8Vw2rdYZhSpDPf2b7C784hB8omtdNXTLhNNX
- slot 443518208 · hash HNaZyAvRYHuU7PRp1XTZn6vG6xSVeZhSsX6n9KUTihEV
- slot 443518180 · hash Aed2o6V23z6DNg8ee5aHZuumJ65DE6jBTnH2SZVJpinW
- slot 443504705 · hash 5pZeeTLbJJ1KNfppZrTQvpf9LxKHDvEq96FS1YfXFaDi
This investigation is cryptographically anchored to the Solana blockchain (9 decisions). 33 of 37 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 8/7/2026, 12:30:07 PM
last updated: 11/3/2026, 11:04:24 PM
5 viewsavoid.net — verified advice for a post-truth world