Key Highlights:
- India's Directorate of Enforcement charged Chirag Tomar and 7 others over a Coinbase spoofing scheme
- The scheme stole more than $20 million from victims by cloning Coinbase's website to harvest login credentials
- Tomar was already sentenced to 60 months in prison in the US — India is now pursuing its own charges
- The group laundered proceeds through multiple wallets, then converted to Indian rupees via P2P transactions
- India has provisionally seized $6.8 million in assets tied to the scheme
India's financial crimes agency has filed charges against eight people over one of the more methodical crypto fraud operations to come to light recently — a fake Coinbase website that quietly harvested login credentials and drained accounts for years.
How the scam worked
The group, led by a man named Chirag Tomar, built spoofed websites designed to look exactly like Coinbase's platform. When victims typed in their login details and two-factor authentication codes, the fraudsters captured those credentials and used them to access the real accounts. They then transferred the crypto to wallets under their control.
From there, the laundering process was methodical: assets moved through multiple wallets, were converted into various forms, and ultimately exchanged for Indian rupees through peer-to-peer transactions — the kind of informal crypto trading networks that operate largely outside traditional financial system monitoring.
The proceeds were deposited into bank accounts linked to Tomar, his family members, associates, and connected entities, then layered through multiple accounts and used to buy both movable and immovable assets.
Where the case stands
Tomar had already been convicted in the United States, where he received a 60-month prison sentence plus two years of supervised release. India's Directorate of Enforcement (ED) opened its own investigation after learning of the US arrest, obtaining evidence through a Mutual Legal Assistance Treaty — the formal channel countries use to share criminal evidence across borders.
As part of its investigation, the ED has provisionally attached 64.55 crore rupees (about $6.8 million) in assets. The prosecution complaint names Tomar, five associates, and two entities.
The bigger picture for crypto crime in India
This comes about three months after India's Central Bureau of Investigation arrested the co-founder and CTO of Darwin Labs at Mumbai airport over an alleged multi-year Ponzi scheme called GainBitcoin. Two major enforcement actions in quick succession points to a more aggressive posture from Indian authorities — notable given that India currently ranks first globally in crypto adoption for the third year running, according to TRM Labs, with the broader South Asia region recording 80% growth in adoption in the first half of 2025.
