The U.S. Department of Justice revealed a sophisticated cryptocurrency scam that exploited fake Coinbase websites to steal more than $20 million from hundreds of victims globally, including many in the United States. Chirag Tomar, an Indian citizen, was sentenced to five years in prison for orchestrating the scheme, which ran from June 2021 until his arrest in December 2023.
How the Scam Worked: Phishing, Remote Access, and Fake Support
Tomar and his co-conspirators created fraudulent websites that closely mimicked the legitimate Coinbase Pro platform. By using near-identical URLs and interfaces, they tricked users into entering their login credentials. Once the information was captured, the attackers immediately used it to access the victims' real Coinbase accounts. In many cases, victims were persuaded to install remote desktop software, giving scammers direct control over their computers and full access to their crypto wallets. A key tactic was impersonating Coinbase customer support agents. Victims either called a fake support number listed on the phishing site or received unsolicited calls from the fraudsters. During these conversations, the scammers convinced victims to share their two-factor authentication codes, which were essential for draining the accounts. The stolen crypto was then rapidly transferred through multiple wallets controlled by Tomar and eventually converted into cash.
Victim Case and Luxurious Spending
A notable incident occurred in February 2022 when a North Carolina resident, after attempting to log in to a fake Coinbase site, believed his account was locked. He contacted a fake support agent and inadvertently disclosed his authentication codes, resulting in a loss of more than $240,000 in cryptocurrency. Tomar used his illicit gains to fund a lavish lifestyle, purchasing expensive cars, luxury watches, and taking international trips. He was arrested at Atlanta Airport in December 2023 and pleaded guilty to conspiracy to commit wire fraud in May 2024. The U.S. Secret Service and the FBI played critical roles in dismantling the operation.
Lessons for Crypto Users
This case highlights the persistent threat of phishing in the crypto space. Users are urged to double-check website URLs, avoid installing remote access software requested by unverified parties, and never share authentication codes with anyone claiming to be support. Always contact the exchange through official channels. The DOJ emphasized that the five-year sentence reflects the severity of the crime, which caused significant financial harm to hundreds of victims. As crypto adoption grows, such scams are likely to become more sophisticated, requiring both user vigilance and stronger security measures from platforms.