Indian national sentenced to 5 years for $20 million Coinbase fraud

Chirag Tomar, a 31-year-old Indian national, was sentenced to five years in federal prison for orchestrating a cryptocurrency fraud scheme that defrauded hundreds of victims of more than $20 million.

U.S. District Judge Kenneth D. Bell handed down the sentence, which also included two years of supervised release.

Scammers imitate Coinbase to steal millions

According to the court documentsTomar and his accomplices executed the fraud by “spoofing” a website designed to imitate the legitimate cryptocurrency exchange Coinbase.

Starting in June 2021, the group created a fraudulent version of the exchange's professional trading site, Pro.Coinbase.com, using a fake URL, CoinbasePro.com. Victims who attempted to log into their Coinbase accounts were tricked into providing their login credentials.

One of the tactics used involved impersonating Coinbase customer service representatives and convincing victims to hand over two-factor authentication (2FA) codes. In other cases, scammers instructed these people to install remote desktop software that would give them full control of their computers.

Tomar used the illicitly obtained credentials to access multiple victim accounts and transfer funds to wallets under his control. He then converted the cryptocurrency into other digital assets, moving them between multiple wallets to conceal the transactions. Ultimately, the funds were converted into cash and distributed among the criminal group.

The 31-year-old used the stolen money to fund a lavish lifestyle, buying luxury watches such as Audemars Piguet, high-end vehicles such as Lamborghinis and Porsches, and traveling to destinations such as Dubai and Thailand.

$240,000 Robbery and Arrest

The plan affected targets around the world, including those based in the Western District of North Carolina. In February 2022, a local attempted to access his Coinbase account through the spoofed site. The fake website instantly alerted them that their account was locked and instructed them to call a number provided to reach a fake Coinbase representative.

The supposed representative then tricked them into revealing their 2FA data. This allowed the scammers to access their target's legitimate Coinbase account. Using this information, the criminals stole more than $240,000 in cryptocurrency from the wallet associated with the account.

This is not the first time incidents of this type have occurred. In 2021, authorities charged Soufiance Oulahya with stealing $450,000 in cryptocurrency and nfts from a Manhattan victim by spoofing the OpenSea marketplace.

Additionally, Convex Finance had to introduce two new alternative URLs after its DNS was hijacked in a phishing attack, causing users to unknowingly approve malicious contracts. Following confirmation of the hijacking, Convex revealed that five wallets had been affected, although verified contracts remained safe.

The threat is not just limited to cryptocurrencies. In 2020, US authorities fined JP Morgan nearly $1 billion for its spoofing practices in metals futures and Treasury securities after it was implicated in FinCEN files for allegedly laundering “dirty money” for worth up to 2 billion dollars.

<!– ai CONTENT END 1 –>