India's Enforcement Directorate (ED) submitted a prosecution complaint before the Special Court in Dwarka, New Delhi on June 15, 2026, targeting Chirag Tomar and his associates in the Coinbase phishing scam. The move marks the transition from asset attachment to formal criminal proceedings under the Prevention of Money Laundering Act (PMLA), 2002.
How the Scam Worked: Fake Sites Outranking Coinbase
Tomar's operation used SEO manipulation to push spoofed Coinbase pages above the legitimate platform in search results. Victims who searched for Coinbase landed on a convincing lookalike and entered their credentials. Fraudsters then called posing as Coinbase representatives, tricking victims into sharing security codes or granting remote access to their computers. Over two years, the scheme drained more than $20 million from victims across the United States. When all laundered funds are included, the total reaches $72 million.
Money Trail: From Crypto to Luxury Cars and Real Estate
ED investigators traced the proceeds through bank accounts linked to Tomar, his family, and entities such as Tomar Group of Industries Pvt. Ltd. and Exahomes Realtors. Funds were layered through multiple accounts before being converted into movable and immovable assets. Seized assets include nine properties in Delhi, several bank accounts, luxury watches, and sports cars including Lamborghinis and Porsches. The total provisional attachment has climbed from Rs 42.8 crore in August 2025 to Rs 64.55 crore as of the June 2026 filing.
Evidence was obtained from U.S. authorities under the Mutual Legal Assistance Treaty (MLAT) framework, said the ED.
Tomar's Status: Serving US Prison Time, Facing Indian Charges
Tomar was arrested at Atlanta's airport in December 2023, pleaded guilty to conspiracy charges in May 2024, and received a five-year federal prison sentence in October 2024. He is currently serving that sentence. The prosecution complaint in India ensures that any assets left in the country remain frozen and that he can be prosecuted upon release.
Sudhakar Lakshmanaraja, founder of blockchain education platform Digital South Trust, commented: "Escaping crypto fraud is no longer an option – bad actors will be tracked, exposed, and jailed."
Warnings for Crypto Users
The ED urged users to never navigate to a crypto exchange through a search result; always use a saved bookmark or type the URL directly. Any unsolicited call claiming to be from Coinbase and asking for codes is a scam. The investigation shows that even after stolen crypto is converted to cash, shuffled through accounts, and turned into real estate, the money trail remains traceable across continents.