India targets $20M crypto fraud scheme

TLDR

Indian authorities have filed formal charges over a Coinbase spoofing scam that allegedly stole more than $20 million in crypto from hundreds of victims.

1. Indias Enforcement Directorate has lodged a prosecution complaint against eight defendants tied to fake Coinbase websites that drained user accounts.
2. Investigators say over $20 million in crypto was siphoned, then laundered into India and converted into real estate, luxury goods, and bank deposits.
3. The case highlights growing global cooperation on crypto crime and offers clear lessons for avoiding phishing-style exchange scams.

Deep Dive

1. What Indian Authorities Are Doing

Indias Enforcement Directorate (ED) has filed a prosecution complaint under the Prevention of Money Laundering Act against Chirag Tomar and seven others over a Coinbase spoofing scheme that stole more than $20 million in crypto from hundreds of users. Authorities have provisionally attached assets worth about 64.55 crore rupees (roughly $6.8 million) that they say are proceeds of crime, including multiple properties and bank balances in India.

The complaint builds on a U.S. case where Tomar was arrested by the FBI in late 2023, pleaded guilty to wire fraud conspiracy, and received a 60?month federal prison sentence, with evidence shared to India via a Mutual Legal Assistance Treaty.

2. How The $20M Fraud Worked

According to ED and media reports, the group built fake websites closely mimicking Coinbases interface, used search-engine ranking and phishing to lure victims, then captured logins and 2FA codes to access real Coinbase accounts. Once inside, they moved crypto to wallets they controlled, routed funds through multiple intermediary wallets, converted into other digital assets, and ultimately cashed out into Indian rupees via peer?to?peer trades and local accounts.

Some proceeds reportedly funded luxury vehicles, international travel, and high?value real estate in India, illustrating how quickly on-chain theft can turn into off-chain lifestyle spending.

3. Why It Matters For Crypto Users

For everyday users, the core risk here is not smart-contract exploits but classic phishing: fake domains, cloned UIs, and impostor customer support agents using remote desktop tools to take over devices. Similar patterns have shown up in other jurisdictions, with fake exchanges and zero?risk schemes promising outsized returns.

Practical defenses include manually typing exchange URLs or using bookmarks, checking certificates, treating unsolicited support calls or screen?share requests as red flags, and using hardware keys or app-based 2FA rather than SMS where possible.

Conclusion

Indias $20 million Coinbase spoofing case shows that large-scale crypto fraud increasingly looks like traditional cybercrime with a blockchain twist, and that law enforcement is getting better at tracing and freezing funds. For crypto users, the biggest takeaway is that basic operational security around logins, URLs, and support interactions remains the most effective protection against this type of attack.