India Files Charges in $20M Coinbase Spoofing Case

India's Enforcement Directorate filed a prosecution complaint on Monday against Chirag Tomar and seven others, alleging a spoofing operation that impersonated Coinbase and diverted more than $20 million from users. The agency has provisionally attached 64.55 crore rupees (about $6.8 million) in assets.

The ED opened the case after learning of Tomar's arrest and conviction in the United States and obtained additional records and evidence through Mutual Legal Assistance Treaty channels with U.S. authorities. Court records show Tomar was sentenced in the U.S. to 60 months in prison followed by two years of supervised release.

The complaint alleges Tomar and co-defendants built counterfeit websites that closely mimicked Coinbase's platform to harvest user login credentials and two-factor authentication codes. After accessing accounts, the group moved cryptocurrency into wallets they controlled and routed funds through multiple intermediary wallets.

According to the filing, the defendants converted stolen crypto into Indian rupees using peer-to-peer transactions. Proceeds were deposited into bank accounts linked to Tomar, family members, associates and related entities, then transferred through a series of accounts before being used to acquire movable and immovable property.

The ED's complaint relies in part on evidence from U.S. criminal proceedings and aims to trace the flow of funds from compromised exchange accounts through conversion and banking channels. The provisional attachment of assets remains in place while the probe continues.

About three months earlier, India's Central Bureau of Investigation detained Ayush Varshney, co-founder and chief technology officer of Darwin Labs, in connection with the multi-year GainBitcoin scheme. Authorities have increased cross-border cooperation in investigations involving digital-asset fraud and money laundering.