CoinbasePro.com spoofing scheme (Chirag Tomar) hack — June 2021

From June 2021 until his arrest in December 2023, Chirag Tomar and co-conspirators ran a spoofed website at CoinbasePro.com, a near-copy of Coinbase's professional trading platform, which at the time was reached at pro.coinbase.com. Victims searching for Coinbase were routed to the fake site and entered their login credentials there.

Where a two-factor prompt blocked access, the group telephoned victims posing as Coinbase customer support and talked them into reading out their authentication codes, in some cases installing remote-access software so they could operate the victim's computer directly. With credentials and codes in hand they logged into the genuine accounts and moved the holdings to wallets Tomar controlled, then converted and split the proceeds. Prosecutors said the money went on Lamborghinis, Porsches, Rolex watches and travel to Dubai and Thailand.

Tomar, an Indian national, was arrested at Atlanta airport on 20 December 2023 following a US Secret Service and FBI investigation, pleaded guilty to wire fraud conspiracy in May 2024, and was sentenced in the Western District of North Carolina on 21 October 2024 to five years in prison.

The Justice Department used two different loss figures at different stages. Its announcement of the guilty plea said Tomar had stolen more than $37 million; its sentencing announcement said more than $20 million taken from hundreds of victims. Prosecutors separately moved for $7.39 million in restitution and the court deferred that decision for 90 days to let the government identify victims and calculate losses, so the adjudicated loss is lower again. One North Carolina victim, named in the case but not here, lost $240,000 in February 2022.