Chirag Tomar is having a rough couple of years. Already sitting in a US federal prison on a five-year sentence for wire fraud conspiracy, the 31-year-old now faces prosecution in India after the country’s Enforcement Directorate filed a formal complaint against him and seven co-defendants over an alleged $20 million Coinbase spoofing scheme.

The ED’s prosecution complaint, filed under India’s Prevention of Money Laundering Act (PMLA), targets Tomar, his brother Pankaj Tomar, and several associates, including an entity called M/s Tomar Group of Industries. The case represents one of the more aggressive cross-border enforcement actions against crypto phishing operations to date.

How the scam worked

The operation ran from June 2021 until Tomar’s arrest at the Atlanta airport on December 20, 2023. Tomar and his associates created counterfeit websites designed to look exactly like the legitimate Coinbase Pro trading platform. Victims who landed on these spoofed pages, including one using the domain coinbasepro.com, were tricked into entering their login credentials.

But harvesting passwords was only step one. The conspirators also employed social engineering tactics to extract victims’ two-factor authentication codes, the very security layer meant to prevent unauthorized access. Once they had both pieces, they essentially held the keys to the kingdom.

The result: more than 542 victims across multiple countries had their accounts drained. Some estimates suggest total losses could reach as high as $37 million, though the prosecution complaint centers on the $20 million figure.

Following the money

US authorities traced the pilfered funds back to multiple real estate holdings and associates in India, which gave the ED the jurisdiction it needed to act.

In November 2025, the ED attached assets worth approximately 21.71 crore rupees, roughly $2.6 million, belonging to Tomar and his associates. Reports indicate the stolen proceeds were laundered and converted into luxury purchases, including high-end vehicles and watches.

The June 2026 prosecution complaint names all eight individuals and entities involved, escalating the matter from asset seizure to formal criminal proceedings in India. This means Tomar now faces legal consequences on two continents simultaneously.

For context, Tomar pleaded guilty in the US to wire fraud conspiracy charges and received a 60-month prison sentence plus supervised release in October 2024. The Indian charges under PMLA carry their own set of penalties, potentially extending his legal troubles well beyond his US sentence.

The bigger picture for crypto security

Coinbase itself was not breached in this operation. The attackers went after users, not the exchange’s infrastructure.

For investors, this case is a reminder that the biggest risk in crypto often isn’t the protocol, the token economics, or the market volatility. Bookmark your exchange URLs. Use hardware security keys instead of SMS-based two-factor authentication. And treat any unsolicited communication asking for credentials the way you’d treat a stranger asking for your house keys.

India’s ED pursuing money laundering charges in a crypto case signals that authorities are building institutional muscle for these prosecutions. Operating across borders used to be a shield. Now, as Tomar is learning, it just means you get prosecuted in multiple jurisdictions at once.