India has intensified its enforcement response to crypto-related fraud, moving to restrain assets allegedly linked to a fake Coinbase scheme that authorities say stole more than $20 million from victims. On Aug. 5, India’s Directorate of Enforcement (ED) announced a provisional attachment order covering assets worth ₹42.8 crore, or about $4.88 million, connected to Chirag Tomar, his relatives, and associated entities.
The attachment is a temporary legal step designed to prevent the transfer, sale, or disposal of property while the investigation continues. According to the ED, the restrained assets include 18 immovable properties in Delhi as well as funds held in bank accounts. The move signals that investigators are not only focused on the alleged online fraud itself, but also on tracing where the proceeds ultimately ended up.
Investigation Followed U.S. Arrest
The Indian agency said its probe began after media reports highlighted the arrest of Indian national Chirag Tomar in the United States. U.S. authorities have accused Tomar of participating in a scheme involving fraudulent websites that imitated the cryptocurrency exchange Coinbase. The ED said Tomar remains in U.S. custody.
In its public statement, the Indian enforcement body described the alleged operation as a large-scale cyber fraud centered on spoofing Coinbase’s website. Investigators said the cloned site was designed to resemble the legitimate exchange closely enough to deceive users, while key contact details were altered to redirect victims to channels controlled by the perpetrators.
The ED specifically stated that the investigation found Tomar was involved in cyber fraud by spoofing the website of the crypto exchange Coinbase and stealing cryptocurrency worth approximately USD 20 million. That figure, if ultimately confirmed through court proceedings, would place the case among the more significant cross-border crypto impersonation scams publicly discussed by law enforcement.
How the Alleged Scam Worked
Authorities said the scheme relied not only on a counterfeit website, but also on search engine optimization techniques that helped the fake page rank prominently in search results. That detail is important because it suggests the operation did not depend solely on phishing links sent directly to victims. Instead, users may have believed they had found an official support channel on their own, making the deception more convincing.
Although the fraudulent website reportedly looked similar to Coinbase’s legitimate platform, investigators said the contact information displayed on it had been changed. Victims who called the listed helpline were allegedly routed to a call center operated by Tomar. Once communication was established, the scammers were able to obtain user credentials and gain control over accounts or related access points.
From there, the stolen funds were allegedly diverted into wallets controlled by the perpetrators. The ED said the assets were later liquidated through peer-to-peer, or P2P, platforms and converted into Indian rupees. This sequence reflects a pattern commonly seen in crypto-enabled fraud cases: digital assets are first moved across wallets, then off-ramped into fiat channels that can be layered through personal or business accounts.
From Crypto Theft to Real Estate
According to the Indian investigation, the converted proceeds were funneled into bank accounts held by Tomar and his family members. Authorities allege that some of those funds were subsequently used to purchase real estate, which is why the attachment order spans both bank deposits and physical properties.
The inclusion of 18 Delhi properties in the restraint order suggests investigators are pursuing the proceeds-of-crime angle as aggressively as the fraud allegations themselves. In practice, such moves can be especially significant because they aim to preserve assets that might otherwise be difficult to recover later if they are sold, transferred, or layered through additional transactions.
For the broader crypto sector, the case is another example of how fraudulent actors can blend online impersonation, call-center manipulation, wallet transfers, P2P cash-out routes, and offline asset purchases into a single laundering chain. It also highlights the challenge facing users: even when they believe they are engaging with a recognized exchange, search visibility and professional-looking interfaces can create a false sense of legitimacy.
Cross-Border Enforcement Is Becoming More Visible
This case also underscores the growing coordination between jurisdictions in crypto-related investigations. The alleged scam activity drew U.S. criminal action, while India is now moving against assets allegedly connected to the proceeds. That combination is notable because enforcement in crypto crime increasingly depends on parallel action: one country may hold a suspect, while another traces local bank accounts, family-linked assets, or property holdings.
India’s provisional attachment order does not by itself determine guilt, but it is a meaningful procedural development. It shows that investigators believe they have identified property linked to the alleged offense and are taking steps to preserve it during the course of the case. Whether those assets are eventually confiscated would depend on further legal proceedings.
Coinbase Chief Legal Officer Paul Grewal responded to the development on X, saying that justice is often delayed but ultimately will not be denied. He also expressed appreciation for the law enforcement work involved in pursuing the alleged fraudster’s assets and referenced prior collaboration that, according to his statement, helped make the action possible.
For market participants, the case is a reminder that some of the most effective crypto scams do not begin with sophisticated smart contract exploits or protocol vulnerabilities. Instead, they often start with brand impersonation, manipulated search results, and direct human interaction through fake support lines. In that sense, the alleged Coinbase clone operation reflects a hybrid form of fraud that combines traditional social engineering with crypto payment rails.
As the case develops, attention will likely remain on two fronts: the U.S. proceedings against Tomar and the Indian effort to identify, restrain, and potentially recover alleged illicit proceeds. Together, those steps may offer a clearer picture of how authorities are adapting to increasingly international, multi-layered crypto fraud operations.