Key Takeaways
- • The IRS is alerting cryptocurrency investors to a sophisticated phishing scam using fake official correspondence and a fraudulent website impersonating the agency's "Digital Asset Compliance Portal," a non-existent IRS tool that criminals are leveraging to harvest sensitive wallet and exchange account credentials.
- • Scammers execute a multi-stage attack: sending official-looking letters to direct victims to a fake IRS website (irs.digitalcomplianceportal[.]com), collecting personal and financial information including crypto exchange credentials, then following up with phone calls to extract passwords, two-factor authentication codes, and private keys needed to access victim accounts.
- • The fraudulent website infrastructure originates from a Hong Kong domain registrar and is hosted in Romania—the same hosting location linked to previous impersonation schemes targeting banks and FedEx—indicating organized, repeat-offender criminal operations with established technical infrastructure.
- • Coinbase and cyber defense firm DarkTower conducted joint investigation work to identify the scam's origins, underscoring heightened security concerns within the cryptocurrency exchange sector and the need for institutional coordination on fraud prevention.
- • The IRS emphasizes that any communication referencing a "Digital Asset Compliance Portal" should be reported immediately, as this fictional entity serves as a primary indicator of fraudulent correspondence targeting crypto holders.
Summary
Fraudsters are conducting a targeted phishing campaign against cryptocurrency investors by impersonating the Internal Revenue Service through forged correspondence and a counterfeit compliance website. According to IRS Criminal Investigation Chief Jarod Koopman, "Criminals continue to exploit public trust in government agencies by creating convincing fake websites and official-looking correspondence." The scam capitalizes on the inherent credibility of official-looking tax authority communications, a long-established social engineering tactic now adapted for the cryptocurrency sector.
The attack unfolds in coordinated stages. Victims receive physical mail appearing to originate from the IRS directing them to visit a Digital Asset Compliance Portal—a non-existent IRS mechanism. The fraudulent website, registered at irs.digitalcomplianceportal[.]com, requests sensitive personal and financial details including cryptocurrency exchange account credentials and wallet information. Once victims submit this data, scammers possess sufficient information to launch the final phase of the attack.
The operational conclusion involves a phone call from someone posing as an IRS representative requesting critical authentication credentials: account passwords, two-factor authentication codes, or private keys. With these elements, attackers gain full access to victim cryptocurrency accounts and can execute unauthorized transfers of digital assets.
Technical investigation by Coinbase and DarkTower revealed that the fraudulent domain is registered through a Hong Kong registrar and hosted on servers located in Romania. This hosting infrastructure overlaps with other documented impersonation campaigns targeting financial institutions and logistics companies, suggesting established criminal operations with reusable technical capabilities. The IRS has explicitly stated that communications referencing a Digital Asset Compliance Portal should be reported immediately, as this fictional entity does not exist within IRS operations and serves as a definitive fraud indicator for cryptocurrency holders and institutional custodians.
The attack unfolds in coordinated stages. Victims receive physical mail appearing to originate from the IRS directing them to visit a Digital Asset Compliance Portal—a non-existent IRS mechanism. The fraudulent website, registered at irs.digitalcomplianceportal[.]com, requests sensitive personal and financial details including cryptocurrency exchange account credentials and wallet information. Once victims submit this data, scammers possess sufficient information to launch the final phase of the attack.
The operational conclusion involves a phone call from someone posing as an IRS representative requesting critical authentication credentials: account passwords, two-factor authentication codes, or private keys. With these elements, attackers gain full access to victim cryptocurrency accounts and can execute unauthorized transfers of digital assets.
Technical investigation by Coinbase and DarkTower revealed that the fraudulent domain is registered through a Hong Kong registrar and hosted on servers located in Romania. This hosting infrastructure overlaps with other documented impersonation campaigns targeting financial institutions and logistics companies, suggesting established criminal operations with reusable technical capabilities. The IRS has explicitly stated that communications referencing a Digital Asset Compliance Portal should be reported immediately, as this fictional entity does not exist within IRS operations and serves as a definitive fraud indicator for cryptocurrency holders and institutional custodians.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.