IRS Fake Digital Asset Compliance Portal Scam (2026)
Summary
Beginning in late July 2026, an organised threat actor began mailing physical letters to U.S. cryptocurrency holders that closely mimicked official IRS correspondence, directing recipients via QR code to a fraudulent 'Digital Asset Compliance Portal' designed to harvest wallet credentials, exchange logins, and identity data. The IRS issued a formal fraud alert on July 30, 2026, explicitly confirming it does not operate any such portal. Coinbase and cybersecurity firm DarkTower traced the campaign infrastructure to a recently registered domain hosted on Romanian servers previously linked to financial phishing networks, indicating a well-organised international fraud operation.
Connected Entities
1 entities · 10 linked investigationsTimeline(9 events)
2026-07-28
Coinbase and cybersecurity firm DarkTower jointly identify the fraudulent Digital Asset Compliance Portal campaign and begin infrastructure analysis.
Crypto Briefing2026-07-30
IRS Criminal Investigation issues a formal fraud alert confirming it does not operate a Digital Asset Compliance Portal, and that the physical letters are fraudulent. IRS-CI Chief Jarod Koopman characterises the operation as a 'professionalized international scam operation.'
IRS.gov — Official Fraud Alert2026-08-03
Journal of Accountancy and CPA Practice Advisor publish warnings directed at accounting professionals and their clients, amplifying the IRS alert.
Journal of Accountancy2026-08-04
Help Net Security publishes a technical breakdown of the campaign, detailing the four-stage attack flow, Hong Kong domain registrar, and Romanian hosting infrastructure previously used for bank and FedEx impersonation phishing.
Help Net Security2026-08-14
Crypto holder @OddStockTrader publicly shares receipt of a fraudulent letter on X, confirming the campaign is actively reaching recipients weeks after the IRS alert.
The Crypto Times2026-08-17
Crypto holder @imjgalt2 shares a photo of the fraudulent notice on X, describing it as looking 'totally legit' and speculating recipient addresses may derive from exchange data breaches.
The Crypto Times2026-08-19
Crypto holder @woodificouldart posts images of a received fraudulent letter on X, further evidencing continued campaign distribution.
The Crypto Times2026-08-20
Forbes publishes an analysis by cryptocurrency tax CPA Shehan Chandrasekera (CoinTracker) explaining the scam's mechanics and providing preventive guidance.
Forbes2026-08-21
The Crypto Times publishes an updated summary of the campaign, confirming letters are still circulating into late August 2026 despite public warnings issued nearly a month prior.
The Crypto TimesDecision Log
- #1publish⛓ pending8/22/2026, 11:07:27 PMhash: Hm2ENjz1d1YoA6YDUxhYaZ8mFwbQURnzP8oGMSRSSHPc
12 of 12 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/22/2026, 11:07:19 PM
last updated: 8/23/2026, 1:56:43 AM
avoid.net — verified advice for a post-truth world