Skip to main content
AVOID.NET
Sign in

IRS Fake Digital Asset Compliance Portal — Physical Mail Phishing

avoid.net/irs-fake-digital-asset-compliance-portal-physical-mail-phishing→0/100·88% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·5fuqGj…2Uro

Summary

Beginning in late July 2026, an unidentified threat actor began mailing counterfeit IRS letters to cryptocurrency holders in the United States, directing recipients to a nonexistent 'Digital Asset Compliance Portal' via embedded QR codes. IRS Criminal Investigation (IRS-CI) publicly confirmed on July 30, 2026, that the portal does not exist and that the agency did not send the letters. Cybersecurity firms Coinbase and DarkTower traced the campaign's infrastructure to a domain registered through a Hong Kong registrar and hosted on Romanian servers previously associated with financial-institution phishing.

Connected Entities

4 entities · 60 linked investigations
Organizations
□IRS Fake Digital Asset Compliance Portal — Physical Mail Phishing□Binance45□Trezor57
Tokens
♦Coinbase62
Relationships
  • IRS Fake Digital Asset Compliance Portal — Physical Mail Phishing→mentioned with→Binance(60%)
  • IRS Fake Digital Asset Compliance Portal — Physical Mail Phishing→mentioned with→Trezor(60%)
  • IRS Fake Digital Asset Compliance Portal — Physical Mail Phishing→mentioned with→Coinbase(70%)
Also appears in
Levyathan·18Jump Trading·42OpenZeppelin AI Exploit Threat Vector·15StableMagnet·2Bankr·18Nexera·32SafePal·42Playsomo·60BearnFi·12Gurhan Kiziloz·0+ 50 more
Have evidence about IRS Fake Digital Asset Compliance Portal — Physical Mail Phishing?
0
Accepted
1
Under review
0
Rejected / revoked

Community submissions

Timeline(5 events)

28 July 2026

Coinbase and DarkTower jointly issue a consumer alert identifying the fraudulent 'Digital Asset Compliance Portal' campaign, flagging the domain infrastructure and attack mechanics.

Crypto Briefing

30 July 2026

IRS Criminal Investigation issues a public fraud alert confirming that the 'Digital Asset Compliance Portal' does not exist and that the agency did not send the letters. IRS-CI Chief Jarod Koopman characterizes it as a 'professionalized international scam operation.' Bloomberg reports on the campaign.

Bloomberg / Accounting Today

31 July 2026

Additional mainstream crypto and financial media outlets including Northeast Times and Crypto Times report on the IRS warning. @IRSnews posts an alert on X.

Northeast Times / IRSnews on X

3 August 2026

Journal of Accountancy and CPA Practice Advisor publish detailed analyses of the scam, including victim guidance and confirmation that no arrests have been made.

Journal of Accountancy

4 August 2026

Help Net Security and Bitdefender publish technical analyses of the phishing infrastructure, confirming the Hong Kong registrar, Romanian hosting, and multi-stage vishing component.

Help Net Security / Bitdefender
Provenance & Audit Trail
Anchored on SolanaVerify on-chain14 Wayback Archives

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (3 events). 14 of 17 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 8/5/2026, 5:19:34 PM

last updated: 9/11/2026, 4:21:22 PM

4 views

avoid.net — verified advice for a post-truth world