The Enforcement Directorate (ED) has advanced its international anti-money laundering investigation by filing a formal prosecution complaint (chargesheet) against Chirag Tomar and his co-conspirators. Submitted before the Special Prevention of Money Laundering Act (PMLA) Court in Dwarka, New Delhi, the charges target a highly sophisticated international cyber syndicate that siphoned over $20 million (~₹166 crore) from hundreds of unsuspecting cryptocurrency investors worldwide. Alongside the formal charges, federal investigators executed fresh provisional attachment orders, pushing the total value of seized and frozen assets linked to the syndicate to approximately ₹64.55 crore.
The Indian domestic investigation operates in tandem with global law enforcement actions following Tomar’s high-profile arrest by the FBI at the Atlanta airport. A United States federal court has already sentenced the 31-year-old mastermind to 60 months in federal prison for wire fraud conspiracy after proving he used the stolen assets to fund an incredibly lavish lifestyle, including trips to Dubai and the acquisition of luxury sports cars like Lamborghinis and Porsches. Utilizing the Mutual Legal Assistance Treaty (MLAT) channels, the ED successfully secured direct evidence from U.S. competent authorities, allowing Indian regulators to map out the complex domestic layering nodes managed by Tomar’s family members, shell corporations, and local associates.
Weaponizing SEO Spoofing to Intercept and Drain Digital Wallets
The operational blueprint behind the multi-million-dollar cyber fraud relied on deceptive website spoofing combined with aggressive Search Engine Optimization (SEO) manipulation. Tomar and his tech-savvy accomplices created a malicious, pixel-perfect clone of the “Coinbase Pro” portal, deliberately hosting it on a confusingly similar domain name (CoinbasePro.com instead of the official pro.coinbase.com link). By heavily optimizing the fake URL to rank at the absolute top of major search engine results, the syndicate ensured that users looking to log into their exchange accounts would naturally click their malicious link first.
Once an unsuspecting victim inputted their official username and password, the fraudulent website would intentionally display a fake access error or account lockout notice. The user would then be prompted to dial a malicious, customer-facing helpline listed on the screen. This number routed directly to a designated, rogue call center managed entirely by Tomar and his close network. Masquerading as official Coinbase support staff, operators would trick panicked users into surrendering their sensitive two-factor authentication (2FA) codes or executing remote-desktop software, giving the hackers full control to immediately drain the victims’ real crypto balances into external personal wallets.
Laundering Foreign Proceeds and Squeezing Corporate Shell Structures
The subsequent integration and clean-up of the illicitly obtained crypto assets exposed a massive peer-to-peer (P2P) layering network engineered to bypass traditional banking flags. The ED’s forensic financial audit established that after intercepting the stolen tokens, Tomar systematically split and bounced the funds across thousands of disposable intermediate wallets. These assets were eventually liquidated into physical fiat currency using decentralized P2P trading desks and domestic Indian crypto exchanges, successfully mixing the criminal proceeds with normal retail transaction volumes.
The laundered Indian currency was directly routed into commercial bank accounts controlled by Tomar, his family, and key entities like the Tomar Group of Industries Private Limited and Exahomes Realtors. The ED’s provisional attachment orders have targeting these specific real estate acquisitions and corporate balances to prevent the dissipation of dirty capital. Among those officially arraigned alongside Chirag Tomar in the chargesheet are prominent close associates and family members including Pankaj Tomar, Kushagra Shakya, Akash Vaish, Rahul Anand, Ketan Luthra, With over 129 associated bank accounts completely frozen and ₹64.55 crore in prime immovable properties locked down, federal investigators are preparing for the next phase of court trials to officially forfeit the properties to the state.
