Fake Coinbase scam tied to $20 million crypto theft from Americans and Indians

India’s Enforcement Directorate has charged six residents and two companies in a crypto fraud case that it says moved more than $20 million out of hundreds of victims. For PSPs and crypto platforms, the mechanics matter: fake exchanges, stolen credentials, remote-access malware, and p2p cash-out are still a very practical fraud stack.

1. The Enforcement Directorate, part of India’s Ministry of Finance, filed fraud charges against six Indian residents and two companies: Tomar Group of Industries Private and Exahomes Realtors.
2. According to the case file, hundreds of people lost digital assets worth more than $20 million. Authorities also seized assets worth about 64,55 crore Indian rupees, or roughly $6,83 million.
3. Investigators say the group built fake websites posing as Coinbase and Coinbase Pro, then collected real Coinbase login details and authentication information. They also impersonated support staff from the US exchange.
4. Remote-access malware was used to control victims’ computers and, after account access was obtained, crypto was transferred to wallets controlled by the accused, the Indian agency said. The scheme had been running since at least June 2021 and affected people in the US, India, and other countries.
5. Authorities say some of the proceeds went into real estate, luxury cars, and international travel, including trips to Dubai. Investigators also allege the stolen crypto was moved through multiple wallets, converted into other digital assets, then routed into Indian rupees through p2p (peer-to-peer) transactions and sent to bank accounts linked to the accused.

The alleged organizer, Chirag Tomar, was arrested by the FBI at Atlanta airport in December 2023, is now in a US prison, and has pleaded guilty to conspiracy to commit fraud. He was sentenced to 60 months in prison followed by two years of supervised release. The rest of the case is still under investigation.