The U.S. Internal Revenue Service has issued a warning about a physical mail phishing campaign targeting cryptocurrency holders. Fraudsters are sending counterfeit letters that resemble official IRS correspondence and include malicious QR codes.
The fake notices claim that recipients must register their digital assets through a nonexistent “Digital Asset Compliance Portal” before a specific compliance deadline. Scanning the QR codes leads to spoofed IRS websites that request sensitive information, including wallet credentials, exchange passwords, seed phrases, and private keys.
The IRS stressed that it does not ask taxpayers for private keys, seed phrases, or wallet verification details when handling cryptocurrency tax matters. Officials advise crypto holders to avoid scanning unfamiliar QR codes in unsolicited mail, verify suspicious correspondence through official IRS channels, and independently check website addresses. Anyone who shared exchange credentials should immediately change passwords and secure affected accounts, while those who exposed private keys or seed phrases may need to move remaining assets to a secure wallet.
