India’s Directorate of Enforcement (ED) today filed a prosecution complaint in a money laundering case linked to a cryptocurrency phishing operation that allegedly targeted users of the crypto exchange Coinbase. The agency said its investigation traced proceeds of crime worth ₹64.55 crore, which have been provisionally attached.
According to the official release, the prosecution complaint, filed before the Special Court in Dwarka, New Delhi, names Chirag Tomar, Pankaj Tomar, Kushagra Shakya, Akash Vaish, Rahul Anand, Ketan Luthra, Tomar Group of Industries Pvt. Ltd., and Exahomes Realtors under the Prevention of Money Laundering Act (PMLA).
Probe began after arrest in the US
The ED said it launched its investigation after reports revealed that Indian national Chirag Tomar had been arrested in the United States for allegedly stealing more than $20 million through phishing websites impersonating Coinbase.
Investigators subsequently sought evidence from US authorities through the Mutual Legal Assistance Treaty (MLAT) framework. According to the ED, the material received helped establish the alleged cross-border operation.
The agency noted that Tomar was arrested by the FBI at Atlanta airport on December 20, 2023, and was later sentenced by a US court to 60 months in prison, followed by two years of supervised release.
Investigators traced flow of stolen cryptocurrency
According to the ED, Tomar and his associates allegedly created fake websites closely resembling Coinbase’s legitimate platform to trick users into revealing login credentials, two-factor authentication codes, and other account access information.
Once victims’ accounts were compromised, investigators allege the cryptocurrency holdings were transferred to wallets controlled by the accused. The agency said the stolen assets were then converted into different virtual digital assets and moved through multiple cryptocurrency wallets before eventually being converted into Indian rupees through peer-to-peer (P2P) crypto transactions.
Funds allegedly routed through companies and real estate
The ED said proceeds from the sale of the allegedly stolen cryptocurrency were deposited into bank accounts belonging to Chirag Tomar, his family members, associated individuals, and entities, including Tomar Group of Industries Pvt. Ltd. and Exahomes Realtors.
According to investigators, the funds were layered through multiple bank accounts before being used to purchase movable and immovable assets, allegedly to disguise the proceeds of crime as legitimate wealth. The agency said it has provisionally attached assets valued at ₹64.55 crore, while the investigation remains ongoing.
ED warns against crypto phishing scams
Alongside the prosecution complaint, the ED urged the public to remain vigilant against phishing attacks targeting cryptocurrency users.
The agency advised users not to click on unknown links or disclose passwords, one-time passwords (OTPs), or other sensitive information through unsolicited emails, messages, or phone calls. It also recommended verifying the authenticity of websites and communications before entering account credentials.
Separate Coinbase data breach probe reached India
The ED’s action comes months after Indian law enforcement became involved in a separate Coinbase-related investigation. In December 2025, Hyderabad Police arrested a former customer service agent allegedly connected to the cryptocurrency exchange’s 2025 data breach. Coinbase CEO Brian Armstrong disclosed the arrest on X, thanking Hyderabad Police and describing it as the first arrest in what he indicated was a broader investigation. Indian authorities have not publicly announced details of the case.
The arrest stemmed from Coinbase’s mid-2025 data breach, in which hackers allegedly bribed outsourced customer support personnel employed by TaskUs, a US-based business process outsourcing company with operations in India, to obtain sensitive customer information.
Although Coinbase said attackers did not gain access to customers’ private keys or passwords, the compromised data allegedly enabled targeted social engineering attacks that tricked users into surrendering access to their accounts.
Crypto fraud cases continue to grow in India
The Coinbase phishing case is the latest in a series of high-profile cryptocurrency investigations in India. Earlier this day, the ED conducted searches and made arrests in an alleged ₹500 crore crypto-based MLM fraud involving Korvio Coin, while Gujarat Police recently expanded a separate investigation into an alleged cryptocurrency network linked to terror financing, narcotics trafficking, and dark web financial operations.
These cases reflect increasing scrutiny by Indian enforcement agencies of cryptocurrency-related fraud, cybercrime, and money laundering activities.
Also Read: Crypto’s Dark Side: Arichain Shuts Down With “We Are Scammers” Confession
