Blab Crypto
Indias Enforcement Directorate Files Prosecution Complaint in $20 Million Coinbase-Spoofing Scam
On Monday, 15 June 2026, the Enforcement Directorate (ED) moved against a sprawling $20 million crypto heist that used counterfeit Coinbase sites to siphon digital assets. The prosecution complaint names a dozen suspects—including Chirag Tomar, Pankaj Tomar, Kushagra Shakya, Akash Vaish, Rahul Anand, Ketan Luthra, the Tomar Group of Industries Private Limited, and Exahomes Realtors—who allegedly orchestrated the fraud.
The scheme’s centerpiece was a series of spoofed Coinbase webpages that mirrored the real exchange’s look and feel. Victims, lured by the familiar interface, entered their login credentials on these fake portals. Once the attackers had access, they transferred the stolen cryptocurrency to wallets under their control, shuffled the tokens through a maze of intermediary addresses, and ultimately converted them into other digital assets. The proceeds were then moved via peer‑to‑peer transactions into Indian rupees and deposited into bank accounts belonging to Tomar, his family members, and associated entities. Reports indicate that the recovered funds were used to purchase real‑estate properties.
Chirag Tomar’s story began in December 2023 when the Federal Bureau of Investigation (FBI) seized him at Atlanta’s airport. A U.S. court later sentenced him to 60 months in prison and imposed two years of supervised release. The ED’s investigation was triggered by media coverage of Tomar’s arrest and was conducted under the Prevention of Money Laundering Act, 2002 (PMLA). Evidence was obtained from U.S. authorities through Mutual Legal Assistance Treaty (MLAT) channels.
In a preliminary step, the ED provisionally attached assets worth approximately ₹64.55 crore. The attachment is part of a broader effort to recover proceeds of crime and prevent further laundering. The agency’s statement underscored that the scheme represented a large‑scale cyber fraud that exploited the trust of cryptocurrency users.
This complaint follows a series of crypto‑related investigations by the ED in 2026. Earlier this year, the agency froze $1.3 million in crypto assets linked to a separate fraud scheme. Across all PMLA investigations involving digital assets, the ED has attached, seized, or frozen more than ₹4,189 crore. In 2026 alone, 29 individuals were arrested and 22 prosecution complaints were filed.
The use of spoofed Coinbase sites has become a recurring tactic in global crypto scams. In October 2024, a U.S. judge sentenced an Indian national to five years in prison for a similar scheme that targeted Coinbase users. The ED’s current complaint highlights the transnational nature of crypto fraud and the importance of international cooperation.
The ED’s focus on cryptocurrency fraud reflects a shift in its enforcement priorities. In May 2026, director Rahul Navin announced that the agency would intensify its efforts against cyber‑enabled crimes, including crypto‑frauds, terror financing, and narcotics trafficking.
The prosecution complaint is the first formal step in the Indian legal process. The ED will seek to prosecute the named suspects under the PMLA and related statutes. The case remains ongoing, and the ED has not yet announced whether additional assets will be attached or whether further suspects will be named.
The incident underscores the growing sophistication of crypto‑scams and the need for robust regulatory oversight. While Coinbase has taken steps to protect its users, the ED’s investigation demonstrates that even large, reputable exchanges can be targeted through phishing and spoofing tactics.
As the case proceeds, the ED is expected to continue collaborating with U.S. authorities and other international partners to trace the flow of stolen funds and recover assets. The outcome of the prosecution will set a precedent for how Indian law enforcement handles cross‑border crypto fraud.
The ED’s filing marks a significant development in India’s fight against financial crime involving digital assets. The agency’s actions signal a commitment to enforcing the PMLA against sophisticated cyber‑fraud schemes and protecting the integrity of India’s financial system.
The scheme’s centerpiece was a series of spoofed Coinbase webpages that mirrored the real exchange’s look and feel. Victims, lured by the familiar interface, entered their login credentials on these fake portals. Once the attackers had access, they transferred the stolen cryptocurrency to wallets under their control, shuffled the tokens through a maze of intermediary addresses, and ultimately converted them into other digital assets. The proceeds were then moved via peer‑to‑peer transactions into Indian rupees and deposited into bank accounts belonging to Tomar, his family members, and associated entities. Reports indicate that the recovered funds were used to purchase real‑estate properties.
Chirag Tomar’s story began in December 2023 when the Federal Bureau of Investigation (FBI) seized him at Atlanta’s airport. A U.S. court later sentenced him to 60 months in prison and imposed two years of supervised release. The ED’s investigation was triggered by media coverage of Tomar’s arrest and was conducted under the Prevention of Money Laundering Act, 2002 (PMLA). Evidence was obtained from U.S. authorities through Mutual Legal Assistance Treaty (MLAT) channels.
In a preliminary step, the ED provisionally attached assets worth approximately ₹64.55 crore. The attachment is part of a broader effort to recover proceeds of crime and prevent further laundering. The agency’s statement underscored that the scheme represented a large‑scale cyber fraud that exploited the trust of cryptocurrency users.
This complaint follows a series of crypto‑related investigations by the ED in 2026. Earlier this year, the agency froze $1.3 million in crypto assets linked to a separate fraud scheme. Across all PMLA investigations involving digital assets, the ED has attached, seized, or frozen more than ₹4,189 crore. In 2026 alone, 29 individuals were arrested and 22 prosecution complaints were filed.
The use of spoofed Coinbase sites has become a recurring tactic in global crypto scams. In October 2024, a U.S. judge sentenced an Indian national to five years in prison for a similar scheme that targeted Coinbase users. The ED’s current complaint highlights the transnational nature of crypto fraud and the importance of international cooperation.
The ED’s focus on cryptocurrency fraud reflects a shift in its enforcement priorities. In May 2026, director Rahul Navin announced that the agency would intensify its efforts against cyber‑enabled crimes, including crypto‑frauds, terror financing, and narcotics trafficking.
The prosecution complaint is the first formal step in the Indian legal process. The ED will seek to prosecute the named suspects under the PMLA and related statutes. The case remains ongoing, and the ED has not yet announced whether additional assets will be attached or whether further suspects will be named.
The incident underscores the growing sophistication of crypto‑scams and the need for robust regulatory oversight. While Coinbase has taken steps to protect its users, the ED’s investigation demonstrates that even large, reputable exchanges can be targeted through phishing and spoofing tactics.
As the case proceeds, the ED is expected to continue collaborating with U.S. authorities and other international partners to trace the flow of stolen funds and recover assets. The outcome of the prosecution will set a precedent for how Indian law enforcement handles cross‑border crypto fraud.
The ED’s filing marks a significant development in India’s fight against financial crime involving digital assets. The agency’s actions signal a commitment to enforcing the PMLA against sophisticated cyber‑fraud schemes and protecting the integrity of India’s financial system.
