According to CoinMeta, the United States Internal Revenue Service (IRS) issued a fraud alert on July 30, stating that scammers were mailing counterfeit notifications, demanding that cryptocurrency holders register through non-existent “digital asset compliance portal” before an emergency deadline. Each fraudulent email contained a QR code that directed recipients to a website impersonating IRS.gov. This counterfeit portal may have requested the submission of personal information, cryptocurrency wallet details, exchange login credentials, mnemonics, private keys, or other data that could be used for theft. Cryptocurrency exchange Coinbase and cybersecurity company DarkTower traced the related infrastructure to a domain name that was registered through a Hong Kong registrar shortly before the emails began circulating. Investigators found that the website was hosted in Romania, and the network it used had previously been associated with phishing pages impersonating financial institutions.