India has intensified its crackdown on crypto-related fraud, moving to seize assets allegedly connected to a large-scale scam built around a fake Coinbase website. On Aug. 5, India’s Enforcement Directorate (ED) announced a provisional attachment order covering assets worth ₹42.8 crore, or about $4.88 million, linked to Chirag Tomar, his relatives, and associated entities. The assets include 18 immovable properties in Delhi as well as funds held in bank accounts.
The attachment order is a temporary legal measure designed to prevent the sale, transfer, or disposal of assets while an investigation is ongoing. In this case, Indian authorities say the move is tied to allegations that Tomar played a central role in a cyber fraud scheme that used a spoofed version of Coinbase’s website to steal cryptocurrency worth more than $20 million from victims.
A U.S. Arrest Triggered the Indian Investigation
According to the ED, its investigation began after reports emerged that Tomar, an Indian national, had been arrested in the United States. U.S. authorities accused him of participating in a scheme that impersonated the cryptocurrency exchange Coinbase through fraudulent websites designed to deceive users. Tomar remains in custody in the U.S., according to the Indian agency’s statement.
The Indian enforcement action shows how crypto fraud cases increasingly stretch across borders. While the alleged conduct involved online impersonation and digital asset theft, investigators are now following the proceeds into the traditional financial system and the real estate market. By attaching bank funds and physical properties, authorities appear to be targeting the full chain of alleged money movement rather than only the wallets used in the scam.
How the Fake Coinbase Operation Allegedly Worked
The ED said the alleged fraud relied on a counterfeit website designed to closely resemble Coinbase’s legitimate platform. Investigators claim the operators used search engine optimization techniques to push the fake site high in search rankings, increasing the likelihood that unsuspecting users would land on it while seeking access to Coinbase services.
Although the spoofed website reportedly looked similar to the real exchange, one critical detail had been changed: the contact information. Instead of directing users to legitimate support, the site allegedly steered victims toward a fraudulent helpline controlled by the perpetrators.
Once victims called the number, they were allegedly connected to a call center operated by Tomar. Investigators say this allowed the scammers to obtain user credentials and gain access to accounts. After securing those details, the perpetrators allegedly diverted funds into wallets under their control, liquidated the assets through peer-to-peer (P2P) platforms, converted the proceeds into Indian rupees, and then routed the money into bank accounts held by Tomar and his family members.
Authorities further allege that some of those proceeds were later used to acquire real estate, which explains why the current attachment order covers a large portfolio of property in Delhi. The case illustrates a familiar pattern in financial crime investigations: illicit digital proceeds are often moved through multiple channels before surfacing as conventional assets such as cash balances or property holdings.
Enforcement Focus Expands Beyond Wallets
The announcement underlines a broader shift in crypto enforcement. Investigators are no longer focused solely on tracing blockchain transactions. They are also examining how stolen crypto may be cashed out, who controls the off-ramp accounts, and whether those funds have been deployed into tangible assets. In this matter, the ED’s action suggests that law enforcement is attempting to preserve recoverable value while the legal process continues.
That approach matters because cyber fraud schemes involving spoofed exchange websites often depend on speed. Once credentials are stolen and digital assets are transferred, criminals may attempt to obscure the trail through rapid liquidation, P2P transfers, or movement across multiple accounts. Temporary asset attachment can give authorities time to investigate without allowing suspects or related parties to dissipate the alleged proceeds.
Coinbase Responds to the Case
Coinbase Chief Legal Officer Paul Grewal commented on the development in a post on X, saying that justice may be delayed but will not be denied. He also thanked law enforcement for pursuing the assets allegedly tied to the fraudster and referenced prior collaboration that helped make the action possible.
His response reflects the increasing role of cooperation between private crypto companies and public agencies in pursuing cybercrime cases. Exchanges often possess platform intelligence, fraud reports, and technical data that can be valuable to investigators. When combined with the powers of national enforcement bodies, that cooperation can improve the odds of identifying operators, tracing proceeds, and preserving assets for potential recovery.
What the Case Means for Users
For crypto users, the case is another reminder that impersonation scams remain one of the sector’s most persistent threats. Fake websites, misleading search results, and fraudulent customer support channels can be highly effective because they exploit trust in well-known brands. The ED’s description of the scheme suggests that the alleged operators did not need to compromise Coinbase itself; instead, they allegedly relied on social engineering, search visibility, and user confusion.
That distinction is important. In many exchange-related scams, the weak point is not necessarily the platform’s core infrastructure but the path users take to reach it. A convincing clone site with altered contact details can be enough to redirect victims into a scammer-controlled support flow, where the theft of credentials becomes possible.
The alleged laundering route described by Indian authorities also offers insight into how scam proceeds may move after the initial theft. The use of wallets, P2P liquidation, fiat conversion, and later deployment into bank accounts and property demonstrates the layered nature of these schemes. It also explains why enforcement agencies are increasingly combining cyber investigation techniques with traditional anti-money laundering tools.
Cross-Border Crypto Policing Is Tightening
At a broader level, the case highlights the growing maturity of international crypto enforcement. A suspect detained in the U.S., assets attached in India, and a fraud allegedly carried out through digital infrastructure spanning multiple jurisdictions point to the complexity of modern crypto crime. They also show that agencies are becoming more willing to coordinate where suspects, victims, and proceeds are spread across borders.
For regulators and law enforcement, the Tomar case may serve as another example of why crypto-related fraud cannot be treated as an isolated online offense. Once proceeds enter banks or are transformed into real estate, the matter quickly intersects with financial intelligence, asset recovery, and anti-money laundering enforcement. For the market, it is a sign that investigations are increasingly moving from blockchain analysis alone to a full-spectrum review of how value is extracted, converted, and stored.
While the legal process is still unfolding and the attachment order is provisional, the ED’s action marks a significant escalation in the case. By freezing nearly $5 million in assets allegedly tied to the operation, Indian authorities are signaling that crypto fraud investigations will not stop at digital wallets. They will follow the money wherever it goes.