The U.S. Department of Justice (DOJ) announced on Thursday that Chirag Tomar, an Indian citizen, has been sentenced to 5 years in prison for his role in a widespread cryptocurrency scam targeting Coinbase users. The scheme involved counterfeit websites mimicking the legitimate Coinbase exchange, which siphoned more than $20 million from hundreds of victims across the globe, including in the United States.
How the Fake Coinbase Scam Worked
According to court records, Tomar and his co-conspirators created a spoofed version of Coinbase Pro, the exchange's professional trading platform, beginning in June 2021. The fraudulent sites used URLs nearly identical to the real site, tricking users into entering their login credentials and two-factor authentication (2FA) codes. Once the data was captured, the attackers immediately used it to access the victims' real Coinbase accounts.
In some cases, the scammers persuaded victims to install remote desktop software, giving the criminals direct control over the victims' computers and full access to their accounts. Another common tactic involved impersonating Coinbase customer service agents. Victims were either directed to call a fake support number or received unsolicited calls from the fraudsters, who then convinced them to disclose their 2FA codes—the final barrier to their accounts.
A Victim’s Story: $240,000 Lost
One notable incident occurred in February 2022 when a North Carolina resident attempted to log into what they thought was Coinbase. After entering their details on the fake site, they were told their account was locked. Contacting a fraudulent support representative, the victim unknowingly provided authentication codes, leading to the loss of over $240,000 in cryptocurrency. The stolen funds were rapidly moved across multiple wallets before being converted into cash. Tomar used the proceeds to fund a lavish lifestyle, purchasing luxury cars, high-end watches, and financing international travel.
Investigation and Legal Outcome
Tomar was arrested at Hartsfield-Jackson Atlanta International Airport in December 2023. By May 2024, he had pleaded guilty to one count of conspiracy to commit wire fraud. In addition to the 5-year prison sentence, he will be required to pay restitution for the stolen assets. The case was investigated jointly by the U.S. Secret Service and the Federal Bureau of Investigation (FBI), which dismantled the fraudulent operation. Tomar remains in custody pending transfer to a federal prison.
The DOJ warned that phishing attacks impersonating legitimate exchanges remain a major threat to cryptocurrency users. Authorities recommend always verifying website URLs, enabling hardware-based security keys, and never sharing 2FA codes with unsolicited callers.