Everything the employer gives you of value for your services, including a sign-up bonus, is supposed to be reported on your W-2 and is subject to regular withholding of income, social security and medicare tax. You should start by contacting the company and requesting a corrected W-2. If they refuse, you have to choose who takes the risk of an audit, you or them. You would be required by law to report the wages using form 8919 with code H. If you don't, and you are unlucky enough to be selected for audit, the problem will be on your head. Yes, the employer could also be investigated. I don't think they would be vulnerable if this was a one-time oversight, but if not, well, that certainly could be an issue for them.
