IRS Warns Crypto Holders of Fake Letters Targeting Digital Assets

The U.S. Internal Revenue Service (IRS) has warned cryptocurrency holders about a new scam involving counterfeit tax letters designed to steal digital assets and sensitive personal information. The fraudulent campaign uses physical mail to direct recipients to a fake “Digital Asset Compliance Portal,” highlighting an evolution in crypto related phishing attacks beyond traditional emails and text messages.

Основные выводы

• The IRS warned that scammers are sending fake tax letters to cryptocurrency holders through physical mail.
• The counterfeit letters direct recipients to a fake “Digital Asset Compliance Portal” that does not exist.
• Victims are encouraged to scan QR codes that lead to phishing websites designed to steal personal information and crypto credentials.
• Investigators found the campaign references tax years 2017 through 2026 and uses a spoofed website hosted overseas.
• The warning comes as crypto scams and cyberattacks continue to target both digital assets and personal data.

IRS Warns of Counterfeit Tax Letter Campaign

IRS уголовное расследование (IRS-CI) division issued a warning after identifying counterfeit letters being mailed to cryptocurrency holders. The fraudulent notices claim recipients must register through a “Digital Asset Compliance Portal” before a stated deadline. However, the IRS confirmed that it does not operate any such portal and is not sending these letters. Instead, the letters contain QR codes that redirect victims to fake websites designed to collect personal information and cryptocurrency related data.

The agency advised taxpayers not to scan QR codes contained in unsolicited letters, emails, or text messages and to avoid responding to callers requesting payments or sensitive information.

Scam Uses Fake Compliance Portal to Steal Information

According to investigators, the fraudulent website closely imitates official government pages to appear legitimate. Victims who scan the QR code are prompted to provide sensitive information that may include:

• Личные идентификационные данные
• Информация о криптовалютном кошельке
• Exchange account credentials
• Wallet recovery phrases or private keys
• Other financial information

Security researchers from Coinbase and DarkTower reported that the campaign references tax years between 2017 and 2026. Their investigation also found that the fraudulent domain was registered through a Hong Kong registrar and hosted on servers located in Romania.

Coinbase warned that victims may later receive phone calls from individuals posing as customer support representatives who attempt to convince them to transfer funds into fraudulent “safe” wallets, a tactic known as voice phishing, or vishing.

Physical Mail Marks New Evolution in Crypto Scams

Unlike traditional phishing campaigns that rely on emails or fake websites, the latest operation uses physical mail to increase credibility. The campaign appears to exploit the growing number of legitimate IRS communications related to cryptocurrency reporting as налог на цифровые активы compliance becomes more common in the United States.

The IRS emphasized that legitimate tax notices do not require taxpayers to use unofficial websites, scan QR codes, or provide криптовалютный кошелек credentials. Anyone who receives unexpected tax related correspondence involving digital assets is encouraged to verify its authenticity directly through official IRS communication channels.

Crypto Scams Continue to Evolve

The IRS warning comes as cryptocurrency related fraud remains a significant concern across the industry. According to industry reports, scams and fraud resulted in billions of dollars in losses during 2025, while impersonation scams increased sharply. Security researchers have also recorded a significant rise in the number of cryptocurrency hacks during the first half of 2026.

Although total financial losses from hacking declined compared with the previous year, the number of attacks reached record levels, suggesting attackers are increasingly targeting users through social engineering and impersonation rather than relying solely on technical exploits.

Заключение

The IRS warning highlights how cryptocurrency scams are evolving beyond traditional online phishing campaigns into physical mail fraud. By using counterfeit tax letters and fake compliance portals, scammers aim to exploit taxpayers’ trust in official government communications to steal digital assets and sensitive personal information.

As cryptocurrency tax reporting becomes more common, investors should carefully verify any unexpected IRS correspondence through official channels and avoid scanning unsolicited QR codes or sharing wallet credentials with anyone claiming to represent government agencies.