India’s Enforcement Directorate has filed a prosecution complaint against 31-year-old Chirag Tomar and seven co-defendants for a $20 million crypto phishing scheme. Tomar is already serving a five-year sentence in a US federal prison for wire fraud conspiracy.
The scam operated from June 2021 until his arrest at the Atlanta airport in December 2023. Tomar and his associates built counterfeit websites mimicking the Coinbase Pro trading platform. They harvested user credentials and, critically, tricked victims into revealing two-factor authentication codes.
More than 542 accounts across multiple countries were emptied. Some estimates place the total loss as high as $37 million. US authorities traced the stolen funds to real estate and luxury purchases in India, including high-end vehicles and watches.
In November 2025, Indian authorities attached assets worth roughly $2.6 million. The new formal complaint escalates the matter from asset seizure to criminal proceedings under the Prevention of Money Laundering Act, meaning Tomar now faces simultaneous legal consequences in the US and India.
Coinbase’s infrastructure was not breached. The attackers exclusively targeted individual users with sophisticated social engineering. The case signals hardening cross-border coordination against crypto crime, proving offshore operations no longer provide legal cover.