India has intensified its crackdown on crypto-related fraud by moving to seize assets connected to an alleged fake Coinbase operation that authorities say defrauded victims of more than $20 million. On Aug. 5, India’s Directorate of Enforcement (ED) announced a provisional attachment order covering assets worth ₹42.8 crore, or roughly $4.88 million, tied to Indian national Chirag Tomar, his relatives, and associated entities.
A provisional attachment order is a temporary legal measure that prevents the sale, transfer, or disposal of assets while an investigation is underway. According to the ED, the attached assets include 18 immovable properties in Delhi as well as funds held in bank accounts. The action marks a significant step in India’s effort to trace and restrain proceeds allegedly generated through cyber-enabled crypto fraud.
Investigation Followed U.S. Arrest
The ED said its investigation was launched after media reports highlighted Tomar’s arrest in the United States. U.S. authorities allegedly linked him to a scheme involving fraudulent websites designed to imitate major crypto exchange Coinbase. Tomar remains in U.S. custody, according to the Indian agency’s statement.
Indian investigators described the operation as a large-scale cyber fraud in which the legitimate Coinbase brand was spoofed to deceive users into believing they were interacting with the real platform. The ED said the scheme centered on a counterfeit website that closely resembled Coinbase’s official interface but contained altered contact details controlled by the fraud network.
Authorities allege that this impersonation campaign was not limited to visual imitation alone. The fake site was also boosted through search engine optimization (SEO) techniques, allowing it to appear prominently in search results and increasing the likelihood that unsuspecting users would land on the fraudulent page. That combination of brand imitation and search visibility appears to have been central to the effectiveness of the scam.
How the Alleged Fraud Worked
According to the ED, victims were prompted to call a fraudulent customer support number listed on the fake website. Instead of reaching Coinbase, they were connected to a call center allegedly operated by Tomar. Once contact was established, the perpetrators reportedly obtained account credentials or other sensitive access information from users.
After gaining control, the fraudsters allegedly diverted victims’ crypto holdings into wallets under their control. The stolen digital assets were then liquidated through peer-to-peer (P2P) platforms and converted into Indian rupees. Investigators say the proceeds were routed into bank accounts held by Tomar and members of his family. Some of those funds were later used to acquire real estate, which now forms part of the attached asset pool.
The ED’s description highlights a layered laundering pathway: stolen crypto moved off victim accounts, was converted through trading channels, deposited into domestic banking rails, and then transformed into tangible assets such as property. That pattern is increasingly familiar in cybercrime investigations, where digital theft is often followed by rapid efforts to convert traceable tokens into conventional assets.
Coinbase Reacts to Enforcement Action
Coinbase Chief Legal Officer Paul Grewal commented on the development on social media platform X, welcoming the move and praising law enforcement cooperation. He said that justice may be delayed, but it will not be denied, and expressed appreciation for efforts to pursue the fraudster’s assets. Grewal also pointed to earlier collaboration discussed in May, suggesting that coordinated action between stakeholders helped make the latest enforcement step possible.
While Coinbase was not accused of wrongdoing, the case underscores the persistent threat of brand impersonation facing major exchanges and financial platforms. Fraudsters often exploit trust in well-known names, using cloned websites, fake support lines, and paid or manipulated online visibility to lure victims into handing over credentials or authorizing transfers.
Broader Implications for Crypto Enforcement
The Indian action is notable not only for the amount attached, but also for what it signals about cross-border cooperation in crypto crime investigations. The suspect is in U.S. custody, the alleged victims were targeted through an online operation mimicking a globally recognized exchange, and the proceeds were allegedly converted and parked in India. That mix of jurisdictions reflects the increasingly international nature of digital asset fraud cases.
For regulators and enforcement agencies, the case demonstrates that crypto-related crime is no longer confined to anonymous wallet activity alone. Modern scams can blend SEO manipulation, fake websites, call-center social engineering, wallet transfers, P2P liquidation, and fiat laundering into a single coordinated operation. Each stage may involve different tools, different service providers, and different legal jurisdictions.
The asset attachment order also illustrates a core enforcement priority: following the money after the initial theft. Freezing bank balances and real estate can be as important as tracing wallet movements, especially when investigators believe stolen digital assets have already been cashed out. In practical terms, such measures aim to preserve value for possible future legal proceedings and prevent suspects or associates from dissipating suspected criminal proceeds.
Although the final judicial outcome remains pending, the latest move by India’s Enforcement Directorate suggests a more assertive stance toward crypto-enabled fraud and related money flows. For users, the case is another reminder that official-looking websites and support channels can still be fraudulent, particularly when discovered through search results rather than trusted bookmarks or verified apps. For the industry, it reinforces the need for stronger user education and continued law enforcement coordination against impersonation-driven scams.