Coinbase Phishing Scam: India ED Files Case, Seizes Rs 64.55 Crore

Coinbase Phishing Scam Verdict: What the Case Means for Crypto Users

The money trail lasted three years. Now it ends in a Delhi court.

India's Enforcement Directorate filed a prosecution complaint on June 15, 2026, before the Special Court in Dwarka, New Delhi — the latest and most serious legal move in the Coinbase phishing scam case that stretches from Atlanta's airport to luxury properties across the Indian capital.

The ED filed its Prosecution Complaint before the Special Court, Dwarka, New Delhi against Chirag Tomar and others under PMLA, 2002 in the Coinbase Phishing Scam case. Total assets provisionally attached now stand at Rs 64.55 crore. The investigation is still ongoing.

Source: X(formerly Twitter)

This is not the beginning of the case. But it may be the moment it becomes impossible to ignore.

How the Coinbase Phishing Scam Stole $20 Million From Victims

The Coinbase phishing scam ran for over two years and was more technically sophisticated than most cybercrime operations at its scale.

Tomar and his associates created fake websites that closely mimicked Coinbase, using search engine optimisation techniques to ensure these fraudulent sites ranked higher than the legitimate platform in search results. Victims searching for Coinbase found a convincing copy instead and never knew the difference.

Once a victim entered their login credentials on the fake site, the operation escalated. Fraudsters posing as representatives would then trick callers into sharing security codes or allowing remote computer access, enabling them to empty the crypto accounts.

The scale of the fraud is striking:

• Over $20 million stolen from victims across the United States

• The 2-year scam generated $72 million in stolen crypto when laundered figures are included

• Hundreds of victims lost their entire crypto holdings with no immediate recovery path

• The provisional attachment order was issued under the Prevention of Money Laundering Act (PMLA), 2002

Tomar was arrested at Atlanta's airport in December 2023 when he returned to the U.S. He admitted guilt to conspiracy charges in May 2024 and received a five-year federal prison sentence in October 2024.

He is currently serving that sentence in the United States. The prosecution complaint filed in New Delhi on June 15, 2026 ensures the Indian legal system now pursues the money trail independently.

How India ED Traced Rs 64.55 Crore Across Borders

The phishing scam investigation in India began the way many cross-border cases do through open-source intelligence.

The ED said it launched its investigation after reports revealed that Indian national Chirag Tomar had been arrested in the United States for allegedly stealing more than $20 million through phishing websites impersonating Coinbase. Investigators subsequently sought evidence from US authorities through the Mutual Legal Assistance Treaty (MLAT) framework. According to the ED, the material received helped establish the alleged cross-border operation.

What investigators found when they followed the money inside India revealed a textbook money laundering operation:

The ED said proceeds from the sale of the allegedly stolen cryptocurrency were deposited into bank accounts belonging to Chirag Tomar, his family members, associated individuals, and entities, including Tomar Group of Industries Pvt. Ltd. and Exahomes Realtors. According to investigators, the funds were layered through multiple bank accounts before being used to purchase movable and immovable assets, allegedly to disguise the proceeds of crime as legitimate wealth.

The assets attached to date include:

• Nine immovable properties located in Delhi held in the names of Tomar, his family members, and associates Rahul Anand, Akash Vaish, and Piyush Prashar

• Bank accounts across multiple entities linked to the Tomar network

• Movable assets including luxury goods

Tomar funneled illegal profits into purchasing high-end timepieces, luxury sports cars including Lamborghinis and Porsches, and financing international travel.

The total provisionally attached now stands at Rs 64.55 crore built up across multiple rounds of ED action from the initial August 2025 seizure of Rs 42.8 crore through the November 2025 addition of Rs 21.71 crore to the June 15, 2026 prosecution complaint filing.

Coinbase Phishing Scam Verdict: What the Case Means for Crypto Users

The prosecution complaint stage marks a significant legal escalation in the Coinbase phishing scam case moving from asset attachment to formal criminal proceedings under PMLA.

For individual crypto users, the case delivers three specific warnings that go beyond general advice:

• Fake sites rank above real ones in search results. Tomar's operation used SEO manipulation to push spoofed Coinbase pages above the legitimate platform. Never navigate to a crypto exchange through a search result — always use a saved bookmark or type the URL directly.

• Coinbase will never call you. The ED urged users not to click on unknown links or disclose passwords, one-time passwords (OTPs), or other sensitive information through unsolicited emails, messages, or phone calls. Any caller claiming to be from a crypto exchange and asking for access codes is running a scam.

• Crypto moves in seconds. But money trails last years. The ED's investigation shows that even after stolen funds are converted to cash, moved through multiple bank accounts, converted to real estate, and layered across family members and company names — the trail remains traceable. Tomar is in prison in the US and still facing prosecution in India.

Sudhakar Lakshmanaraja, founder of blockchain education platform Digital South Trust, confirmed the broader signal: "Escaping crypto fraud is no longer an option bad actors will be tracked, exposed, and jailed."

The Coinbase phishing scam case is now one of the most documented examples of cross-border crypto crime enforcement. India used MLAT evidence from the US. The US conviction supported the Indian attachment orders. The prosecution complaint in Delhi ensures any assets remaining in India stay frozen while proceedings continue.

Conclusion

The Coinbase phishing scam prosecution complaint filed on June 15, 2026 closes the loop on a $20 million fraud that began with a fake website and ended with Rs 64.55 crore in frozen Indian assets. Chirag Tomar is in a US prison. His properties are attached in Delhi. The money trail that fraudsters assumed would disappear followed them across two continents. Never use a search engine to find your crypto exchange. Bookmark it. Always.

YMYL Disclaimer

This article is for informational and educational purposes only. All prosecution complaint details are sourced from the official Enforcement Directorate dated June 15, 2026.The Indian prosecution complaint represents a criminal charge — not a final conviction in India. All asset attachment figures are provisional and subject to court proceedings. This article does not constitute legal advice. Always report suspected crypto fraud to your national cybercrime authority.