Audit log

Every state-changing event for IRS Fake Digital Asset Compliance Portal Phishing Campaign 2026: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-01 17:18:23Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   BG9LrTKhTQVn…QQnTwdtScopysha256 → base58

   verifying row…

   canonical bytes (16951 B) ▸

   {"actor":"system:backfill","investigation_id":"ce124313-4762-44fc-8303-caef158070b8","kind":"publish","page_slug":"irs-fake-digital-asset-compliance-portal-phishing-campaign-2026","published_at":"2026-08-01T17:18:23.510Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"IRS Fake Digital Asset Compliance Portal Phishing Campaign 2026","sections":[{"content":"Beginning in late July 2026, U.S. cryptocurrency holders began receiving physical letters purporting to be official IRS correspondence. The letters referenced tax years 2017 through 2026, claimed recipients were required to enroll in a 'Digital Asset Compliance Portal' (DACP) before an August 10, 2026 deadline, and included a QR code directing recipients to the fraudulent domain 'irs.digitalcomplianceportal.com'. The campaign was identified by Coinbase and threat intelligence firm DarkTower, who issued a consumer alert on July 28, 2026. IRS Criminal Investigation formally warned the public on July 30, 2026. IRS-CI Chief Jarod Koopman stated: 'Criminals continue to exploit public trust in government agencies by creating convincing fake websites and official-looking correspondence.' The IRS confirmed it operates no Digital Asset Compliance Portal and does not request digital asset transfers or sensitive credentials through mailed notices.","heading":"Campaign Overview","severity":"critical","sources":[{"credibility":2,"name":"IRS warns crypto holders fraudster sending fake letters in attempt to steal digital assets or data — The Block","type":"news_article","url":"https://www.theblock.co/post/410204/irs-crypto-holders-fraudster-sending-fake-letters-steal-digital-assets-data-bloomberg"},{"credibility":2,"name":"IRS warns of counterfeit letters targeting crypto holders with fake compliance portal — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/irs-warns-counterfeit-letters-crypto-holders/"},{"credibility":2,"name":"Consumer Protection Tuesday: A Fake IRS 'Digital Asset Compliance Portal' Letter Is Targeting Crypto Holders — Coinbase Blog","type":"official","url":"https://www.coinbase.com/blog/consumer-protection-tuesday-fake-irs-scam"},{"credibility":1,"name":"IRS Warns of Scam Using Fake Letters to Steal Crypto Wallets and Identities — Bloomberg","type":"news_article","url":"https://www.bloomberg.com/news/articles/2026-07-30/scam-artists-are-posing-as-irs-agents-to-drain-crypto-wallets"}]},{"content":"The campaign used physical mail — an uncommon vector in cryptocurrency fraud — to bypass email spam filters and exploit the familiarity of crypto holders with genuine IRS digital asset letters the agency has sent since 2019. Letters arrived in plain envelopes formatted to mimic official IRS correspondence. Upon scanning the embedded QR code, recipients were taken to a convincing spoofed IRS enrollment page. The phishing site prompted victims to select which platform held their crypto assets — listing major exchanges including Coinbase, Kraken, and Binance — reportedly to identify which platform to subsequently impersonate. The site then requested personal identification details, cryptocurrency wallet information, recovery phrases, exchange account credentials, and phone numbers. According to Coinbase's consumer alert, after initial data entry a scammer posing as 'support' would attempt vishing (voice phishing) contact to further manipulate victims into transferring assets or surrendering account access. The IRS confirmed that legitimate IRS letters do not contain QR codes.","heading":"Attack Methodology","severity":"critical","sources":[{"credibility":2,"name":"IRS warns of counterfeit letters targeting crypto holders with fake compliance portal — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/irs-warns-counterfeit-letters-crypto-holders/"},{"credibility":2,"name":"Consumer Protection Tuesday: A Fake IRS 'Digital Asset Compliance Portal' Letter Is Targeting Crypto Holders — Coinbase Blog","type":"official","url":"https://www.coinbase.com/blog/consumer-protection-tuesday-fake-irs-scam"},{"credibility":2,"name":"Did You Get an IRS Crypto Compliance Letter? It Probably Isn't Real — Yahoo News","type":"news_article","url":"https://www.yahoo.com/news/us/articles/did-irs-crypto-compliance-letter-082951104.html"},{"credibility":2,"name":"IRS Warns Crypto Holders About Fake Tax Letter Scam — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/07/31/irs-warns-crypto-holders-about-fake-tax-letter-scam/"}]},{"content":"The fraudulent domain 'irs.digitalcomplianceportal.com' was registered through a Hong Kong-based domain registrar only days before the physical letters were distributed. The website was hosted on servers in Romania that were already known to security researchers for hosting phishing pages impersonating FedEx and financial institutions. Reporting by The Star (citing Bloomberg) characterized the operation as a 'professional, international fraud operation' based on the rapid infrastructure setup and prior track record of the hosting network. The identity of the operators has not been publicly confirmed. No arrests or indictments directly related to this campaign had been announced as of August 1, 2026.","heading":"Technical Infrastructure","severity":"high","sources":[{"credibility":2,"name":"Scam artists are posing as IRS agents to drain crypto wallets — The Star (citing Bloomberg)","type":"news_article","url":"https://www.thestar.com.my/tech/tech-news/2026/07/31/scam-artists-are-posing-as-irs-agents-to-drain-crypto-wallets"},{"credibility":2,"name":"Crypto Scam Surge: Fraudsters Use Fake IRS Letters to Steal Investor Information — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/crypto-scam-surge-fraudsters-use-fake-irs-letters-to-steal-investor-information/"},{"credibility":2,"name":"IRS Warns 'Digital Asset Compliance Portal' Is A Scam Targeting Crypto Taxpayers — Bitcoin World","type":"news_article","url":"https://bitcoinworld.co.in/irs-warns-digital-asset-compliance-portal-scam/"}]},{"content":"IRS Criminal Investigation issued a public alert on July 30, 2026, warning U.S. taxpayers of the campaign. IRS-CI Chief Jarod Koopman confirmed the agency operates no Digital Asset Compliance Portal and does not request personal or financial information via mailed QR codes. The IRS directed recipients of suspicious letters to verify correspondence through IRS.gov and report incidents via www.IRS.gov/SubmitATip. The Accounting Today report of the same date reproduced key IRS-CI guidance: cease communication with the sender, change any compromised passwords, contact financial institutions, preserve evidence, and report to IRS-CI. Coinbase published a consumer warning on July 28, 2026, crediting DarkTower as the threat intelligence source that identified the campaign. As of August 1, 2026, the IRS had not disclosed the volume of letters distributed nor any confirmed financial losses attributable to the campaign.","heading":"Official Warnings and Regulatory Response","severity":"high","sources":[{"credibility":1,"name":"IRS-CI issues alert about potential cryptocurrency phishing scam — IRS.gov","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/irs-ci-issues-alert-about-potential-cryptocurrency-phishing-scam"},{"credibility":2,"name":"IRS warns crypto holders of fake letters — Accounting Today","type":"news_article","url":"https://www.accountingtoday.com/news/irs-ci-warns-of-fake-irs-letters-targeting-crypto-holders"},{"credibility":2,"name":"Consumer Protection Tuesday: A Fake IRS 'Digital Asset Compliance Portal' Letter Is Targeting Crypto Holders — Coinbase Blog","type":"official","url":"https://www.coinbase.com/blog/consumer-protection-tuesday-fake-irs-scam"}]},{"content":"The DACP campaign emerged against a documented backdrop of escalating crypto-related fraud. According to the FBI Internet Crime Complaint Center (IC3), Americans lost over $11 billion to crypto-related scams in 2025, a reported 22% increase year-over-year, with an average loss of $62,604 per victim and over 18,000 cases exceeding $100,000 in losses. Chainalysis data cited in reporting noted impersonation scams surged 1,400% in 2025, with total scam losses reaching $17 billion that year. TRM Labs recorded more than 207 hacks in the first half of 2026 — more than double the prior-year period — suggesting a broader industry shift from technical protocol exploits toward social engineering targeting individual holders. The DACP campaign exploited a specific credibility vector: since 2019, the IRS has legitimately mailed educational letters to taxpayers regarding unreported digital assets, creating a population of recipients already conditioned to expect IRS correspondence about crypto. In parallel, the FBI's IC3 warned in July 2026 of criminals impersonating IC3 itself using AI-generated videos and spoofed websites to re-victimize prior fraud victims.","heading":"Broader Context: Crypto Impersonation Scam Trends","severity":"medium","sources":[{"credibility":2,"name":"Scam artists are posing as IRS agents to drain crypto wallets — The Star","type":"news_article","url":"https://www.thestar.com.my/tech/tech-news/2026/07/31/scam-artists-are-posing-as-irs-agents-to-drain-crypto-wallets"},{"credibility":2,"name":"Crypto Scam Surge: Fraudsters Use Fake IRS Letters to Steal Investor Information — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/crypto-scam-surge-fraudsters-use-fake-irs-letters-to-steal-investor-information/"},{"credibility":2,"name":"IRS Fake Crypto Tax Letters: How to Spot the Scam — Crypto Daily","type":"news_article","url":"https://cryptodaily.co.uk/2026/08/irs-fake-crypto-tax-letters-scam"}]},{"content":"IRS-CI and security researchers identified the following indicators of the fraudulent letters: (1) letters arriving in plain unmarked envelopes rather than official IRS envelopes; (2) inclusion of a QR code — the IRS states it does not include QR codes in official correspondence; (3) references to an 'August 10' enrollment deadline creating artificial urgency; (4) direction to a domain other than IRS.gov; (5) requests for cryptocurrency wallet credentials, recovery phrases, or exchange login details. Recommended protective actions include: do not scan the QR code; do not call any phone numbers listed in the letter; do not enter any personal or financial information on linked websites; verify unexpected IRS correspondence directly at IRS.gov; report the letter to IRS-CI at www.IRS.gov/SubmitATip; and file a complaint with the FBI IC3 at IC3.gov, including any wallet addresses, domains, or phone numbers found in the letter.","heading":"Identification and Protection Guidance","severity":"medium","sources":[{"credibility":2,"name":"IRS warns of counterfeit letters targeting crypto holders with fake compliance portal — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/irs-warns-counterfeit-letters-crypto-holders/"},{"credibility":2,"name":"Consumer Protection Tuesday: A Fake IRS 'Digital Asset Compliance Portal' Letter Is Targeting Crypto Holders — Coinbase Blog","type":"official","url":"https://www.coinbase.com/blog/consumer-protection-tuesday-fake-irs-scam"},{"credibility":2,"name":"IRS warns crypto holders of fake letters — Accounting Today","type":"news_article","url":"https://www.accountingtoday.com/news/irs-ci-warns-of-fake-irs-letters-targeting-crypto-holders"}]}],"sources_used":[{"credibility":1,"name":"IRS-CI issues alert about potential cryptocurrency phishing scam — IRS.gov","type":"regulatory","url":"https://www.irs.gov/compliance/criminal-investigation/irs-ci-issues-alert-about-potential-cryptocurrency-phishing-scam"},{"credibility":1,"name":"IRS Warns of Scam Using Fake Letters to Steal Crypto Wallets and Identities — Bloomberg","type":"news_article","url":"https://www.bloomberg.com/news/articles/2026-07-30/scam-artists-are-posing-as-irs-agents-to-drain-crypto-wallets"},{"credibility":2,"name":"IRS warns crypto holders fraudster sending fake letters in attempt to steal digital assets or data — The Block","type":"news_article","url":"https://www.theblock.co/post/410204/irs-crypto-holders-fraudster-sending-fake-letters-steal-digital-assets-data-bloomberg"},{"credibility":2,"name":"IRS warns of counterfeit letters targeting crypto holders with fake compliance portal — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/irs-warns-counterfeit-letters-crypto-holders/"},{"credibility":2,"name":"Consumer Protection Tuesday: A Fake IRS 'Digital Asset Compliance Portal' Letter Is Targeting Crypto Holders — Coinbase Blog","type":"official","url":"https://www.coinbase.com/blog/consumer-protection-tuesday-fake-irs-scam"},{"credibility":2,"name":"IRS Warns Crypto Holders About Fake Tax Letter Scam — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/07/31/irs-warns-crypto-holders-about-fake-tax-letter-scam/"},{"credibility":2,"name":"IRS warns crypto holders of fake letters — Accounting Today","type":"news_article","url":"https://www.accountingtoday.com/news/irs-ci-warns-of-fake-irs-letters-targeting-crypto-holders"},{"credibility":1,"name":"IRS Warns Crypto Users of Fake Letters in Data-Stealing Scam — Bloomberg Tax","type":"news_article","url":"https://news.bloombergtax.com/daily-tax-report/irs-warns-crypto-users-of-fake-letters-in-data-stealing-scam"},{"credibility":2,"name":"Did You Get an IRS Crypto Compliance Letter? It Probably Isn't Real — Yahoo News","type":"news_article","url":"https://www.yahoo.com/news/us/articles/did-irs-crypto-compliance-letter-082951104.html"},{"credibility":2,"name":"IRS Warns 'Digital Asset Compliance Portal' Is A Scam Targeting Crypto Taxpayers — Bitcoin World","type":"news_article","url":"https://bitcoinworld.co.in/irs-warns-digital-asset-compliance-portal-scam/"},{"credibility":2,"name":"Scam artists are posing as IRS agents to drain crypto wallets — The Star","type":"news_article","url":"https://www.thestar.com.my/tech/tech-news/2026/07/31/scam-artists-are-posing-as-irs-agents-to-drain-crypto-wallets"},{"credibility":2,"name":"Crypto Scam Surge: Fraudsters Use Fake IRS Letters to Steal Investor Information — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/crypto-scam-surge-fraudsters-use-fake-irs-letters-to-steal-investor-information/"},{"credibility":2,"name":"IRS Fake Crypto Tax Letters: How to Spot the Scam — Crypto Daily","type":"news_article","url":"https://cryptodaily.co.uk/2026/08/irs-fake-crypto-tax-letters-scam"},{"credibility":3,"name":"Coinbase Support warning on X — @CoinbaseSupport","type":"social_media","url":"https://x.com/CoinbaseSupport/status/2082145747277881537"}],"summary":"In late July 2026, an unidentified threat actor mailed counterfeit IRS letters to U.S. cryptocurrency holders directing them to a fictitious 'Digital Asset Compliance Portal' (DACP) at a lookalike domain. IRS Criminal Investigation (IRS-CI) issued a public warning on July 30, 2026, confirming no such portal exists and that the campaign was designed to harvest personal information, exchange credentials, and digital asset holdings. The phishing infrastructure was registered through a Hong Kong registrar and hosted on Romanian servers with a prior history of financial phishing activity.","timeline":[{"date":"2026-07-28","event":"Coinbase and threat intelligence firm DarkTower issued a consumer alert identifying the fake DACP letter campaign.","source":"Coinbase Blog","source_url":"https://www.coinbase.com/blog/consumer-protection-tuesday-fake-irs-scam"},{"date":"2026-07-30","event":"IRS Criminal Investigation (IRS-CI) issued a formal public warning confirming the campaign. IRS-CI Chief Jarod Koopman stated criminals were creating convincing fake websites and official-looking correspondence. The IRS confirmed it operates no Digital Asset Compliance Portal.","source":"Bloomberg / Accounting Today","source_url":"https://www.bloomberg.com/news/articles/2026-07-30/scam-artists-are-posing-as-irs-agents-to-drain-crypto-wallets"},{"date":"2026-07-31","event":"Multiple crypto and mainstream news outlets including The Block, Crypto Briefing, Crypto Times, and Gate News published coverage of the IRS warning. Coinbase Support posted a public advisory on X (Twitter).","source":"The Block","source_url":"https://www.theblock.co/post/410204/irs-crypto-holders-fraudster-sending-fake-letters-steal-digital-assets-data-bloomberg"},{"date":"2026-08-01","event":"As of this date, no confirmed victim counts, financial losses, arrests, or indictments related to the DACP campaign had been publicly disclosed. The August 10 enrollment deadline cited in the fraudulent letters had not yet passed.","source":"IRS / Multiple outlets","source_url":"https://www.accountingtoday.com/news/irs-ci-warns-of-fake-irs-letters-targeting-crypto-holders"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 81370692-d14b-406f-9e64-0ff33907b532copy