TheBlock
India's Directorate of Enforcement (ED) filed a prosecution complaint against Chirag Tomar and seven other individuals and entities in connection with an alleged Coinbase spoofing scheme that stole more than $20 million from victims, the agency said in a Monday statement. The group is accused of building lookalike websites designed to mimic Coinbase's platform, harvesting user login credentials and two-factor authentication codes, then siphoning crypto holdings through layered wallets and off-ramping the proceeds into Indian rupees via peer-to-peer transactions.
The ED has provisionally attached 64.55 crore rupees — roughly $6.8 million — in assets linked to Tomar, his family, associates, and group entities. The agency obtained evidence through Mutual Legal Assistance Treaty channels from U.S. authorities after Tomar's earlier arrest and 60-month federal prison sentence, followed by two years of supervised release.
Why it matters
The case is the latest high-profile state intervention into India's crypto fraud pipeline, coming roughly three months after the Central Bureau of Investigation arrested GainBitcoin co-founder Ayush Varshney at Mumbai airport over an alleged multi-year Ponzi. That back-to-back cadence suggests Indian federal agencies are treating cross-border crypto enforcement as a sustained priority, not a one-off — the ED explicitly leaned on U.S. MLAT cooperation, a template that will be reusable for future cross-jurisdictional probes.
The seizure ratio also signals a shift in the country's posture. Attaching $6.8M of a $20M alleged haul shows the ED is willing to move on asset freezes inside India even when the underlying scam and the principal defendant live abroad, broadening the legal surface for victims and counterparties to pursue recovery.
Market impact
For Coinbase, the case is reputational rather than structural: the spoofing rode on lookalike domains outside its control, but each high-profile impersonation incident tightens the optics for retail platforms operating in markets where brand recognition outpaces user-side security literacy.
Frequently asked questions
-
What is the Coinbase spoofing scam the ED is prosecuting?
India's Enforcement Directorate alleges that Chirag Tomar and seven others built lookalike Coinbase websites to harvest user login credentials and 2FA codes, then drained victim crypto holdings, layered them through multiple wallets, and off-ramped the proceeds into Indian rupees via P2P transactions.
-
How much has India seized in the case so far?
The ED has provisionally attached 64.55 crore rupees — roughly $6.8 million — in assets linked to Tomar, his family members, associates, and group entities as part of the ongoing probe.
-
What happened to alleged ringleader Chirag Tomar in the U.S.?
Tomar was previously arrested in the United States and sentenced to 60 months in federal prison followed by two years of supervised release. The ED obtained evidence from U.S. authorities through Mutual Legal Assistance Treaty channels.
-
How does this case fit into India's broader crypto enforcement push?
The action comes roughly three months after India's Central Bureau of Investigation arrested GainBitcoin co-founder Ayush Varshney at Mumbai airport over an alleged multi-year Ponzi, suggesting federal agencies are treating cross-border crypto fraud as a sustained priority.
-
Why does this matter for India's crypto market?
India retained the top spot in TRM Labs' 2025 global crypto adoption index for a third straight year, with South Asian adoption up 80% year-on-year between January and July 2025 — meaning federal enforcement is now scaling in lockstep with one of the world's largest retail crypto user bases.
Altcoin Daily
CoinDesk
CryptoSlate
WuBlockchain