Chirag Tomar, an Indian national, pleaded guilty on May 20, 2024, to conspiracy to commit wire fraud after prosecutors said a counterfeit Coinbase website and fake customer-support calls helped a network take cryptocurrency from hundreds of victims. On October 17, 2024, a federal judge sentenced him to 60 months in prison followed by two years of supervised release.
The case was an account-takeover and social-engineering operation—not evidence that criminals breached Coinbase’s core systems. The U.S. Department of Justice described a spoofed website, stolen credentials and two-factor-authentication information, remote-access software, and transfers from victims’ genuine accounts.
As an Amazon Associate I earn from qualifying purchases.
The case in brief
Tomar was 30 when he entered his guilty plea and 31 when he was sentenced. He was arrested on December 20, 2023, at Atlanta airport while entering the United States and remained in federal custody through the proceedings. The Western District of North Carolina prosecuted him for wire-fraud conspiracy.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsAccording to the DOJ, the alleged scheme began in June 2021 and involved co-conspirators who targeted Coinbase users in the United States and elsewhere. The plea announcement attributed more than $37 million in stolen cryptocurrency to the broader scheme. The later sentencing announcement described more than $20 million stolen from hundreds of victims. The releases do not explain why those figures differ, so they should not be treated as interchangeable or as a single final loss amount.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
| Date | Event |
|---|---|
| June 2021 | Prosecutors said the scheme began. |
| February 2022 | A North Carolina victim described by the DOJ lost more than $240,000 in cryptocurrency. |
| December 20, 2023 | Tomar was arrested at Atlanta airport. |
| May 20, 2024 | He pleaded guilty to wire-fraud conspiracy. |
| October 17, 2024 | He received a 60-month prison sentence and two years of supervised release. |
The plea announcement is available from the U.S. Attorney’s Office for the Western District of North Carolina. The sentencing announcement is at justice.gov.
How the fake Coinbase site enabled account takeovers
A convincing domain imitation
Investigators said the conspirators created CoinbasePro.Com to resemble Coinbase’s former Pro service. The DOJ cited the legitimate former URL as Pro.Coinbase.Com. Those are different domain structures, but a hurried user could read both as a familiar Coinbase login destination.
The counterfeit page was designed to capture login credentials and authentication information. A branded page, a familiar-looking logo, or a domain containing a company’s name does not establish that a financial login page is genuine.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Fake lockout notices and telephone support
In at least some cases, the site told users that their accounts were locked and displayed a telephone number. When a victim called, the person answering allegedly posed as a Coinbase representative and requested two-factor-authentication information.
This is social engineering rather than a technical defeat of two-factor authentication. The attacker persuaded the user to disclose a one-time code or otherwise gave the attacker control of the user’s session or device. Prosecutors also said some victims were persuaded to install or permit remote-desktop software.
Access to the real account
With credentials, authentication information, or remote access, the fraudsters entered victims’ genuine Coinbase accounts and transferred cryptocurrency to wallets controlled by Tomar and associates. The described conduct is best understood as phishing, spoofing, and cryptocurrency account takeover—not as a direct hack of Coinbase’s infrastructure.
Rank #3
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
The documented $240,000 victim loss
The DOJ described a victim in the Western District of North Carolina who, in February 2022, tried to log in through the fraudulent website. After seeing a lockout message, the victim called the number shown there and disclosed two-factor-authentication information. The fraudsters then accessed the real Coinbase account and took cryptocurrency worth more than $240,000.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →That account is an illustrative example from the indictment and plea facts, not a claim that every victim experienced the same sequence.
Why the loss figures are different
| DOJ announcement | Amount reported | How to describe it |
|---|---|---|
| May 20, 2024 plea release | More than $37 million | Prosecutors’ description of cryptocurrency stolen in the broader scheme. |
| October 17, 2024 sentencing release | More than $20 million | The amount cited in the sentencing announcement for losses from hundreds of victims. |
The public releases do not state whether the difference reflects a different loss calculation, a narrower set of transactions, or another sentencing distinction. Without the underlying judgment or related court filings, it would be inaccurate to call either number the definitive final loss.
Rank #4
- EAL5+ CERTIFIED SECURE ELEMENT + FINGERPRINT PROTECTION — Your private keys stay encrypted offline on a certified EAL5+ chip, the same security tier used in EMV bank cards. Built by DCENT, securing crypto since 2018. Fingerprint authentication adds a second layer no PIN-only wallet can match.
- 10,000+ ASSETS NATIVE ON 100+ BLOCKCHAINS — Hold Bitcoin, Ethereum, XRP, Solana, Cardano, popular stablecoins (USDT, USDC), and NFTs in one wallet. No third-party apps, no fragmented setup — every supported asset works straight out of the box.
- TAP-TO-SIGN MOBILE EXPERIENCE — Pair your wallet with the DCENT mobile app over Bluetooth. Manage tokens, review transactions, and access in-app swap features directly from your phone — no cables, no desktop required.
- WEB3 & dAPP ACCESS VIA METAMASK — Connect to MetaMask and other browser extension wallets to manage NFTs, claim airdrops, and access dApps. A large screen and intuitive 4-button interface keep every transaction clearly visible before you sign.
- SEAMLESS FIRMWARE UPDATES & 30-DAY MONEY-BACK GUARANTEE — Apply security updates without resetting your wallet or migrating funds. Backed by Amazon's 30-day money-back guarantee — your purchase is risk-free.
Where prosecutors said the cryptocurrency went
According to the DOJ, Tomar controlled multiple cryptocurrency wallets that received hundreds of transactions from victim accounts. The assets were converted into other cryptocurrencies, moved through additional wallets, and eventually converted to cash. Proceeds were distributed among Tomar and co-conspirators.
Blockchain transfers are not automatically anonymous. Moving funds through several wallets, assets, exchanges, and jurisdictions can complicate tracing, but investigators can still analyze transaction records. Prosecutors said the proceeds supported luxury watches, Lamborghini and Porsche vehicles, and trips to Dubai, Thailand, and elsewhere.
Arrest, plea, and sentence
Arrest and guilty plea
Tomar was arrested on December 20, 2023, when he entered the United States through Atlanta. On May 20, 2024, he admitted the wire-fraud conspiracy in federal court. The investigation involved the U.S. Secret Service, with assistance from the FBI’s Nashville office.
Best Value
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
Statutory maximum versus punishment imposed
The DOJ said the conspiracy charge carried a statutory maximum of 20 years in prison and a $250,000 fine. That was the legal ceiling, not the sentence Tomar was expected to receive or ultimately received.
On October 17, 2024, U.S. District Judge Kenneth D. Bell imposed 60 months in federal prison and two years of supervised release. The sentencing release does not state a restitution or forfeiture amount, and it does not establish that all victims were reimbursed or that all stolen assets were recovered.
Security lessons for cryptocurrency users
- Reach exchanges through a saved bookmark or manually entered official domain. Do not rely on search-result advertisements, unsolicited messages, or links supplied by an unexpected caller.
- Inspect the complete domain. A brand name in a domain is not proof of ownership; compare the exact domain and its structure with a previously verified address.
- Never give a one-time code to “support.” A genuine representative should not need you to read a two-factor-authentication code aloud.
- Reject unsolicited remote-access requests. Disconnect or refuse software that lets another person control your computer or phone.
- Be skeptical of lockout messages and phone numbers. Contact the exchange through a channel you already know is official, not through a number displayed by a suspicious page.
- Use phishing-resistant authentication where available. Passkeys and hardware security keys can reduce exposure to credential phishing, although availability varies by exchange and account type.
If you may have shared credentials or access
- Stop communicating with the caller and end any remote-access session.
- From a clean device, change the exchange password and the password for the associated email account.
- Revoke active sessions, connected devices, API keys, and withdrawal permissions.
- Contact the exchange through its independently verified support channel and report the account takeover.
- Preserve transaction hashes, wallet addresses, messages, phone numbers, and screenshots for investigators.
- Be wary of anyone promising guaranteed cryptocurrency recovery; recovery scams often target people after an initial loss.
What the public record does not establish
- Why the DOJ releases use more than $37 million at the plea stage and more than $20 million at sentencing.
- The exact number of victims or the identities and outcomes of other alleged co-conspirators.
- Whether a court ordered restitution or forfeiture, and how much money or cryptocurrency was recovered.
- Whether every victim followed the credential-and-phone-call sequence described in the North Carolina example.
The Bottom Line
Tomar’s five-year sentence followed a phishing and impersonation campaign that used a fake Coinbase-branded site and bogus support calls to obtain access to real customer accounts. The case’s central warning is practical: verify the full domain, never disclose authentication codes, and treat unsolicited account-lockout support as a potential takeover attempt.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
