Skip to main content
Sign in

IRS Fake Digital Asset Compliance Portal — Physical Mail Phishing

avoid.net/irs-fake-digital-asset-compliance-portal-physical-mail-phishing→0/100·88% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Summary

Beginning in late July 2026, an unidentified threat actor began mailing counterfeit IRS letters to cryptocurrency holders in the United States, directing recipients to a nonexistent 'Digital Asset Compliance Portal' via embedded QR codes. IRS Criminal Investigation (IRS-CI) publicly confirmed on July 30, 2026, that the portal does not exist and that the agency did not send the letters. Cybersecurity firms Coinbase and DarkTower traced the campaign's infrastructure to a domain registered through a Hong Kong registrar and hosted on Romanian servers previously associated with financial-institution phishing.

Connected Entities

1 entities · 10 linked investigations
Organizations
□IRS Fake Digital Asset Compliance Portal — Physical Mail Phishing
Relationships
    Also appears in
    edgeX Exchange·28Mach-O Man Malware Campaign (Lazarus / Chollima)·0Trenton Richard Johnston·2Q2 2026 DeFi Record Hack Wave·0Alephium Bridge·18Interpol Operation First Light 2026 — $123M Romance Scam Crypto Network·5BonkDAO Treasury Governance Attack (July 2026)·3Shunda Park Scam Compound·0Chen Zhi / Prince Group·2Thorchain DEX·28
    Have evidence about IRS Fake Digital Asset Compliance Portal — Physical Mail Phishing?

    Timeline(5 events)

    2026-07-28

    Coinbase and DarkTower jointly issue a consumer alert identifying the fraudulent 'Digital Asset Compliance Portal' campaign, flagging the domain infrastructure and attack mechanics.

    Crypto Briefing

    2026-07-30

    IRS Criminal Investigation issues a public fraud alert confirming that the 'Digital Asset Compliance Portal' does not exist and that the agency did not send the letters. IRS-CI Chief Jarod Koopman characterizes it as a 'professionalized international scam operation.' Bloomberg reports on the campaign.

    Bloomberg / Accounting Today

    2026-07-31

    Additional mainstream crypto and financial media outlets including Northeast Times and Crypto Times report on the IRS warning. @IRSnews posts an alert on X.

    Northeast Times / IRSnews on X

    2026-08-03

    Journal of Accountancy and CPA Practice Advisor publish detailed analyses of the scam, including victim guidance and confirmation that no arrests have been made.

    Journal of Accountancy

    2026-08-04

    Help Net Security and Bitdefender publish technical analyses of the phishing infrastructure, confirming the Hong Kong registrar, Romanian hosting, and multi-stage vishing component.

    Help Net Security / Bitdefender
    Provenance & Audit Trail
    10 Wayback Archives

    Decision Log

    • #1publish⛓ pending8/5/2026, 5:19:44 PM
      hash: 47bn3LcBdTEtBbC16btwr6bThJUCPGVh7noShQCuchoy

    10 of 17 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-sonnet-4-6

    generated: 8/5/2026, 5:19:34 PM

    last updated: 8/5/2026, 6:59:13 PM

    avoid.net — verified advice for a post-truth world