Crypto Exchanges

Story: Fake IRS Letters Are Draining Crypto Wallets — Here’s the Infrastructure Behind It

By James Thorp

1 / 15

What happened. Fraudsters are sending counterfeit IRS notices to cryptocurrency holders, directing them toward a…

2 / 15

The historical context. Crypto holders have been targeted this way before. Not once. Repeatedly.

3 / 15

Why it matters. The damage here runs in two directions at once.

4 / 15

What to watch. A few things are worth tracking as this develops.

5 / 15

Posing as trusted institutions to extract sensitive information is an age-old con, but its persistence keeps catching people off guard.

6 / 15

Fraudsters are sending counterfeit IRS notices to cryptocurrency holders, directing them toward a fake "Digital Asset Compliance Portal" built to steal sensitive data.

7 / 15

Back in 2019, a wave of phishing emails hit users of exchanges including Binance and Kraken. The messages looked like official platform communications.

8 / 15

Scammers don't reinvent the wheel. They update it. Each cycle of fraud absorbs lessons from the last one — better domain spoofing, more convincing language, faster infrastructure…

9 / 15

For victims, it's immediate and personal — financial loss, identity theft, compromised accounts. For the broader crypto industry, it's reputational.

10 / 15

See also: Galaxy Research Puts Coldcard Bitcoin Loss at $70.2M Across 1,196 Wallets

11 / 15

There's also a harder structural problem. The international setup of this operation — Hong Kong registration, Romanian hosting — isn't accidental.

12 / 15

The involvement of companies like Coinbase and cybersecurity firm Darktower in tracing the scam's digital footprint is worth noting.

13 / 15

The number of phishing incidents reported to the IRS over the coming months will say a lot about how far this particular campaign has spread.

14 / 15

See also: CoinFlip-Style Hardware Hack: $70 Million Gone From 1,196 Coldcard Wallets

15 / 15

Coinbase's response — and the response of other major exchanges — is also worth watching. Specifically, whether any new security protocols or user education pushes come out of…

The Currency Analytics

Want the full story?