IRS Fake Digital Asset Compliance Portal Phishing Campaign 2026
Summary
In late July 2026, an unidentified threat actor mailed counterfeit IRS letters to U.S. cryptocurrency holders directing them to a fictitious 'Digital Asset Compliance Portal' (DACP) at a lookalike domain. IRS Criminal Investigation (IRS-CI) issued a public warning on July 30, 2026, confirming no such portal exists and that the campaign was designed to harvest personal information, exchange credentials, and digital asset holdings. The phishing infrastructure was registered through a Hong Kong registrar and hosted on Romanian servers with a prior history of financial phishing activity.
Connected Entities
1 entities · 10 linked investigationsTimeline(4 events)
2026-07-28
Coinbase and threat intelligence firm DarkTower issued a consumer alert identifying the fake DACP letter campaign.
Coinbase Blog2026-07-30
IRS Criminal Investigation (IRS-CI) issued a formal public warning confirming the campaign. IRS-CI Chief Jarod Koopman stated criminals were creating convincing fake websites and official-looking correspondence. The IRS confirmed it operates no Digital Asset Compliance Portal.
Bloomberg / Accounting Today2026-07-31
Multiple crypto and mainstream news outlets including The Block, Crypto Briefing, Crypto Times, and Gate News published coverage of the IRS warning. Coinbase Support posted a public advisory on X (Twitter).
The Block2026-08-01
As of this date, no confirmed victim counts, financial losses, arrests, or indictments related to the DACP campaign had been publicly disclosed. The August 10 enrollment deadline cited in the fraudulent letters had not yet passed.
IRS / Multiple outletsDecision Log
- #1publish⛓ pending8/1/2026, 5:18:23 PMhash: BG9LrTKhTQVnt2grLsxgaACWP29qcFTzpCK8QQnTwdtS
11 of 14 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/1/2026, 5:18:13 PM
last updated: 8/1/2026, 9:05:54 PM
avoid.net — verified advice for a post-truth world