The Internal Revenue Service has issued a warning to cryptocurrency holders about a wave of fraudulent letters designed to steal private keys and other sensitive wallet information. Scammers are mailing physical notices that closely resemble official tax correspondence and include QR codes linking to websites that impersonate the IRS.

These counterfeit letters instruct recipients to register their digital assets through a supposed government system called the Digital Asset Compliance Portal. The IRS has confirmed that no such portal exists. The notices often create a sense of urgency by citing an impending compliance deadline, pushing recipients to act quickly.

How the Scam Operates

Physical mail can make the scheme appear more legitimate because taxpayers commonly receive authentic government notices through traditional postal channels. The letters use official-looking formatting and branding to increase credibility. Yet the presence of government-style design does not mean the document originated from the IRS.

QR codes printed on the fraudulent letters play a central role. Scanning them redirects users to websites built to look like legitimate IRS pages. Once there, victims may be prompted to connect cryptocurrency wallets or submit account credentials. Scammers also seek personal details, exchange passwords, seed phrases, private keys, and other security information.

Providing such data can give criminals direct access to cryptocurrency accounts and, in some cases, full control over the digital assets. Users who hand over private keys or recovery phrases risk exposing their wallets without any further action required by the attackers.

Steps Crypto Holders Should Take

Taxpayers who receive unsolicited correspondence about digital assets should avoid scanning any unfamiliar QR codes. Instead, they can verify the notice through official IRS communication channels before responding or following any instructions.

Recipients should also examine website addresses independently rather than trusting links or codes included in unexpected mail. This helps identify imitation sites created solely to harvest account information.

Anyone who has already submitted exchange credentials through a suspicious website should change passwords right away and secure the affected accounts. Contacting the relevant cryptocurrency exchange can assist in addressing possible unauthorized access on centralized platforms.

Wallet owners who disclosed seed phrases or private keys face a more severe risk because those credentials grant full control over the funds. In such cases, transferring remaining assets to a newly secured wallet may be required to limit further losses.

Protecting Against Similar Campaigns

The warning illustrates how scammers combine traditional postal delivery with digital phishing tactics to target cryptocurrency holders. Verifying unexpected tax notices through official channels and safeguarding wallet credentials remain essential measures against this type of campaign.

Cryptocurrency owners are advised to remain cautious with any unsolicited requests involving digital assets and to rely only on confirmed IRS resources when handling tax-related matters.