Recently, an Indian citizen has pled guilty to wire fraud conspiracy for stealing more than $37 million from a bogus Coinbase website used to acquire credentials.
Chirag Tomar, 30, was arrested at the Atlanta airport in December last year following a joint investigation by the United States government and the FBI about his case.
Based on reports, Tomar and his co-conspirators used the “coinbasepro.com” domain to establish a phoney website that impersonated Coinbase Pro in a fraud campaign in June 2021. These perpetrators allegedly designed the site to deceive legitimate Coinbase customers into entering their login credentials and 2FA codes.
This bogus site was finally shut down in November 2022, with its functionality and features merged into the main Coinbase platform as part of the service’s unification efforts. During that time, Tomar phished Coinbase accounts, obtaining control of other people’s Bitcoin wallets and then moving their assets to wallets under his control.
The phishing tactic for this Coinbase scam capitalised on social engineering strategies.
Investigations revealed that this fraudster’s phishing scheme mainly employed social engineering tactics. Authorities explained that the perpetrators used a bogus login problem to entice victims to contact a fake Coinbase representative, who subsequently accessed the victim’s computer via remote access software.
In other instances, victims were tricked into allowing fake Coinbase representatives to execute remote desktop software, enabling the scammers to gain control of victims’ computers and access their legitimate Coinbase accounts.
The fraudsters also impersonated customer service representatives and tricked the users into giving their 2FA codes to the fraudsters over the phone call or SMS—one case featured in the United States.
According to reports, Tomar controlled several cryptocurrency wallets that received hundreds of transactions of cryptocurrency stolen from victim accounts at Coinbase. After he received the stolen crypto asset, he would quickly convert it to other forms of cryptocurrency or transfer the funds amongst the many wallets he or his co-perpetrators controlled.
Eventually, they converted the cryptocurrency into cash and distributed it to Tomar and his team.
Tomar used the stolen money to finance an extravagant lifestyle, including expensive watches, supercars, and luxurious vacations in various countries. The fraudster now faces a possible 20-year prison sentence and a fine of $250,000.
