IRS Warns Cryptocurrency Holders of Fake Letters

Scammers are sending physical letters to cryptocurrency holders that mimic official IRS notices. The letters claim recipients must enroll in the Digital Asset Compliance Portal (DACP) before a deadline or face penalties.

The IRS has warned that this is a scam, and no such portal exists. Coinbase, working with threat intelligence firm DarkTower, investigated one of these letters after a customer reported receiving it.

DarkTower traced the site's infrastructure to a domain registered in Hong Kong just days before the letters went out, hosted on Romanian infrastructure previously linked to phishing pages impersonating banks and delivery services.

The fake letter arrives in a plain envelope with Treasury and IRS branding, a notice number, tax year range, and deadline. It includes a QR code that leads to a site copying the look of a government portal.

Visitors are asked to choose which exchange or wallet they use, estimate their holdings' value, and enter a phone number for a 'representative' call to complete verification.

This is where the scam unfolds. Posing as support staff, scammers push victims to hand over one-time codes, passwords, or seed phrases, or move funds into a controlled wallet.

DarkTower tested this flow and found that no callback came, leaving two possibilities: the call may come later, or phone numbers and exchange choices are harvested for future social engineering attempts.