India indicts eight in $20 million Coinbase phishing scheme, seizes millions in assets

India’s Directorate of Enforcement (ED) has formally indicted eight individuals and entities for orchestrating a sophisticated phishing scheme that impersonated the cryptocurrency exchange Coinbase, resulting in the theft of over $20 million from users. The indictment, reported by The Block, marks a significant step in cross-border efforts to combat crypto-related cybercrime.

The phishing operation and its mechanics

According to the ED, the group created a fraudulent website that closely mimicked the official Coinbase platform. Victims were tricked into entering their login credentials and two-factor authentication (2FA) codes, which the perpetrators then used to access real accounts. Once inside, the stolen cryptocurrency was transferred to wallets under the group’s control, routed through multiple intermediary wallets to obscure the trail, and ultimately converted into Indian rupees via peer-to-peer (P2P) transactions.

The investigation revealed a highly organized operation. The ED provisionally attached assets worth 6.455 billion rupees (approximately $6.8 million) during its probe, freezing funds and property linked to the accused.

International cooperation and prior U.S. sentencing

One of the key figures in the case, Chirag Tomar, was previously sentenced in the United States to 60 months in prison followed by two years of supervised release for his role in the scheme. The ED launched its own investigation after receiving evidence from U.S. authorities through a Mutual Legal Assistance Treaty (MLAT), a formal mechanism that enables countries to share information and cooperate in criminal investigations.

This case underscores the growing importance of international legal frameworks in tackling crypto fraud, which often spans multiple jurisdictions.

Why this matters for cryptocurrency users

Phishing attacks remain one of the most common and effective methods for stealing cryptocurrency. This incident highlights the need for users to verify website URLs carefully, use hardware wallets for large holdings, and enable advanced security features such as whitelisting withdrawal addresses. It also serves as a reminder that even well-known platforms like Coinbase can be targeted by sophisticated impersonation schemes.

For the broader crypto industry, the case demonstrates that law enforcement agencies are increasingly capable of tracing stolen funds and prosecuting offenders across borders, potentially deterring future attacks.

Conclusion

The indictment of eight individuals in connection with the $20 million Coinbase phishing scheme represents a notable success for international law enforcement cooperation. With assets worth nearly $7 million already seized and key figures facing prison time, the case sends a strong signal that crypto-related fraud will be pursued aggressively. Users are advised to remain vigilant and adopt best practices for account security.

FAQs

Q1: How did the phishing scheme work?
The group created a fake Coinbase website that looked identical to the real one. Victims entered their login credentials and 2FA codes, which the attackers used to access their accounts and steal cryptocurrency.

Q2: What is the Mutual Legal Assistance Treaty (MLAT)?
An MLAT is a formal agreement between countries that allows them to share evidence and cooperate in criminal investigations. In this case, U.S. authorities provided materials to India’s ED under such a treaty.

Q3: What should I do to protect myself from similar attacks?
Always double-check website URLs, enable hardware-based 2FA, avoid clicking on links in unsolicited emails or messages, and consider using a hardware wallet for large cryptocurrency holdings.