India’s Enforcement Directorate has moved forward with legal action in a high-profile cryptocurrency fraud case tied to the theft of more than $20 million in digital assets. The agency filed a prosecution complaint before the Special Court in Dwarka, New Delhi, against Chirag Tomar and several associates under the Prevention of Money Laundering Act.
According to the investigation, the accused allegedly operated fake websites designed to imitate the cryptocurrency exchange Coinbase and used them to steal account credentials from victims. Authorities claim the stolen cryptocurrency was later laundered through multiple transactions and converted into Indian currency.
ED Files Prosecution Complaint in Major Crypto Fraud Investigation
The Enforcement Directorate named Chirag Tomar, Pankaj Tomar, Kushagra Shakya, Akash Vaish, Rahul Anand, Ketan Luthra, Tomar Group of Industries Private Limited, and Exahomes Realtors in the prosecution complaint.
The agency said it initially began examining the case after reports emerged that Chirag Tomar, an Indian national, had been arrested in the United States for allegedly stealing more than $20 million through websites that mimicked Coinbase’s platform.
During the investigation, Indian authorities sought evidence and case records from U.S. authorities through Mutual Legal Assistance Treaty (MLAT) channels. The information received helped investigators trace the alleged fraud operation and the movement of funds.
How the Alleged Coinbase Spoofing Scheme Worked?
According to the ED, the accused created fraudulent websites that closely resembled the legitimate Coinbase platform. Victims were allegedly tricked into entering sensitive information, including login credentials, authentication codes, and other account access details.
Once access was obtained, investigators allege that cryptocurrency holdings were transferred from victims’ accounts into wallets controlled by members of the group.
U.S. court records cited in reports indicate that the operation allegedly targeted hundreds of victims across multiple countries. Prosecutors also alleged that members of the scheme at times impersonated Coinbase customer support representatives and used remote desktop software to gain access to victim accounts.
One reported victim from North Carolina allegedly lost more than $240,000 during the scheme.
FBI Arrest and U.S. Conviction
The investigation revealed that Chirag Tomar was arrested by the Federal Bureau of Investigation at Atlanta airport on December 20, 2023.
He later pleaded guilty in the United States to wire fraud conspiracy charges linked to the Coinbase spoofing operation. A U.S. court sentenced him to 60 months of imprisonment, followed by two years of supervised release.
U.S. authorities alleged that the fraud operation generated more than $20 million in stolen cryptocurrency from hundreds of victims.
ED Traces Crypto Funds to Assets in India
The Enforcement Directorate said the stolen cryptocurrency was allegedly converted into different virtual digital assets and routed through multiple wallets to obscure its origin.
Investigators claim the funds were eventually converted into Indian Rupees through peer-to-peer cryptocurrency transactions and deposited into bank accounts linked to Chirag Tomar, his family members, associates, and related entities.
According to the agency, the money was then used to purchase both movable and immovable properties in India in an attempt to present the proceeds as legitimate assets.
As part of the case, the ED has provisionally attached assets worth ₹64.55 crore. The agency stated that further investigation remains ongoing.
Increased Focus on Crypto-Related Money Laundering
The case highlights the growing scrutiny of cryptocurrency-related financial crimes in India. Authorities have increasingly focused on monitoring digital asset transactions under anti-money laundering regulations.
The Enforcement Directorate said it continues to investigate the movement of funds and the role of individuals and entities linked to the alleged fraud. The agency also urged citizens to remain cautious of phishing attempts, fake websites, suspicious links, and fraudulent communications designed to steal personal and financial information.