IRS warns cryptocurrency holders to beware of false letters claiming assets

How does fake IRS letter fraud work?

The IRS is warning cryptocurrency holders to be wary of forged letters designed to steal digital assets, personal information or taxpayer data. Fraudulent letters may direct recipients to register through a so-called "digital asset compliance portal." The IRS said the portal does not exist and any letters guiding taxpayers to use the service are fraud. Some letters may contain QR codes that point to fraudulent websites or direct recipients to call phone numbers controlled by fraudsters. The IRS advises taxpayers not to scan unfamiliar QR codes or respond to any calls requesting payment, account information, or cryptocurrency transfers. The use of physical mail makes the scam appear more legitimate than ordinary email phishing. Paper letters with tax-related language can be particularly deceptive when they arrive, especially at a time when the IRS is intensifying its review of digital asset reports. Scammers may also use a sense of urgency to warn taxpayers that they will face fines, account restrictions or enforcement action if they do not respond quickly. Any legal tax correspondence should be verified through official IRS channels before providing information or payment.

Why are cryptocurrency holders vulnerable to tax impersonation fraud?

As the IRS expands its regulation of digital asset transactions, IRS communications about cryptocurrencies have become more common. U.S. taxpayers are required to answer questions about digital asset activity on their tax returns, and the IRS has previously mailed notices about cryptocurrency reporting obligations. Last year, a large number of real cryptocurrency-related tax notices caused confusion for thousands of taxpayers. This background provides fraudsters with the opportunity to imitate real government communications and take advantage of recipients who may have expected to receive questions about transactions, earnings or reporting errors. The scam also targets a group that is unusually profitable for criminals. Unlike unauthorized bank transfers, cryptocurrency transactions are often difficult to revoke after funds have been transferred out. If victims transfer tokens to fraudsters, they have limited means to recover assets. Asking for wallet credentials, mnemonics or private keys is another warning sign. Tax authorities can verify reported activity without obtaining a taxpayer's private wallet key. Anyone who obtains these credentials may have complete control of the assets in the wallet.

Note to Investors

Cryptocurrency holders should view unexpected tax letters as a matter requiring verification rather than a requirement for immediate payment. The safest approach is to contact the IRS through independently confirmed official channels, rather than using a telephone number, QR code or website printed in the letter.

Why is physical email a more persuasive tool?

Phishing emails, fraudulent websites and fake phone calls are common in the digital asset space, but forged government letters add a physical element and make scams appear more credible. Recipients may believe that criminals lack the personal information needed to send targeted emails. In fact, names and addresses can be obtained through data breaches, public records, or information purchased from the criminal market. Including basic personal information does not prove that the letter came from the government. Physical emails may also reach people who have learned to distrust unsolicited cryptocurrency emails but are still not cautious enough about seemingly official envelopes. Scammers can copy agency logos, formats and legal terms, but the documents produced are not actually issued by the IRS. Taxpayers should check whether the letter requires the use of unfamiliar portals, immediate payments in cryptocurrency, or disclosure of information that can access their accounts. Requests involving digital assets, gift cards or transfers to private wallets should be seen as a strong signal of fraud.

How can cryptocurrency threats transcend online attacks?

The warning comes as cryptocurrency crimes increasingly include both digital intrusions and physical targets. Blockaid, a blockchain security company, said that in the first half of 2026, cryptocurrency projects lost more than $1 billion due to hacking attacks. Blockaid said this period was the most hacking attack in six months on record based on the number of incidents rather than the total value stolen. The finding suggests that attackers are targeting a wider range of projects, users and infrastructure, even if the amount of a single theft is less than the largest vulnerability in industry history. Cryptocurrency holders also face the risk of so-called "wrench attacks," in which criminals use physical attacks, threats or extortion to force victims to surrender assets or wallet access. Security company CertiK reported more than 50 such incidents in the first half of this year, with the largest number recorded in Europe. Fake letter scams fall somewhere in between. It starts with traditional email but attempts to steer victims into digital payment or data theft processes. This combination allows criminals to leverage tax enforcement related authorities while targeting assets that can be transferred quickly and irreversibly. For exchanges, wallet providers and investors, the IRS warning provides another reason to strengthen the verification process surrounding government letters. As digital asset ownership becomes more common, fraudsters are adapting common tax scams into the language, reporting rules and payment methods of the cryptocurrency market.