US sentences man to 5 years in prison for $20 million crypto fraud involving fake Coinbase website

An Indian national was sentenced to prison after stealing more than $20 million from hundreds of victims using a spoofed website that mimicked the crypto exchange Coinbase, according to the United States Department of Justice.

U.S. District Judge Kenneth D. Bell sentenced Chirag Tomar, 31, to 60 months in prison, followed by two years of supervised release, Dena J. King, U.S. Attorney for the Western District of North Carolina, and Jason Byrnes, Special Agent in Charge of the United States Secret Service, Charlotte Field Office, announced on Thursday.

Tomar reportedly spent the victims' funds on a lavish lifestyle, including buying luxury items such as Audemars Piguet watches and expensive cars like Lamborghinis and Porsches. He also used the money to fund trips to destinations including Dubai and Thailand.

He was arrested at the Hartsfield-Jackson Atlanta International Airport on Dec. 20, 2023, upon entering the United States. On May 20, 2024, he pleaded guilty to wire fraud conspiracy. Tomar remains in federal custody and will be transferred to a Federal Bureau of Prisons facility once designated, the DOJ said.

U.S. Attorney King praised the U.S. Secret Service for investigating the case and thanked the FBI in Nashville for their assistance.

Spoofing Coinbase

According to court filings and Thursday’s sentencing hearing, beginning by at least June 2021, Tomar and his co-conspirators engaged in a spoofing scheme to steal millions in cryptocurrency from victims worldwide, including the United States. They created a fake website mimicking Coinbase Pro under a similar URL to deceive users into entering their login credentials and two-factor authentication codes, which allowed them to access victims' legitimate Coinbase accounts. Alternatively, by posing as Coinbase customer service representatives, they tricked other users into providing authentication details over the phone or enabling remote desktop access to their computers, facilitating the theft of their cryptocurrency.

Once the scammers accessed the victims' accounts, they transferred the cryptocurrency to wallets under their control. The stolen funds were then moved across multiple addresses, converted into other forms of cryptocurrency, and eventually cashed out. One victim from North Carolina lost over $240,000 alone due to the fraudulent scheme.