New Delhi: The Enforcement Directorate (ED) has provisionally attached assets worth ₹21.71 crore in a sprawling international crypto fraud case valued at approximately ₹166 crore. The attachments include residential units, commercial properties and land parcels purchased by the accused using proceeds of crime.
This action centres on Chirag Tomar, his family members and several associates who allegedly operated an organised network that siphoned cryptocurrency from foreign investors through fake login portals of global crypto exchanges.
This is the second major attachment in the case. Earlier, ED had seized assets totalling ₹64.15 crore, taking the overall value of attached properties to nearly ₹86 crore.
Spoofed Crypto Websites Pushed to the Top Through SEO Manipulation
Investigators found that the gang created multiple spoofed websites resembling legitimate crypto platforms such as Coinbase. These cloned sites were then artificially boosted using aggressive Search Engine Optimization (SEO), ensuring they appeared above the genuine websites in search results.
Unsuspecting users searching for terms like “Coinbase login” or “crypto wallet support” would land on these fake portals and enter their credentials, believing they were interacting with the official platform.
Once a login attempt failed, the site displayed a “customer support number,” which actually connected directly to the gang’s call-centre operators.
These operators, posing as: account verification staff, customer service agents, or multi-chain wallet support executives, would then convince victims to share passphrases, 2FA codes, or recovery keys. The scammers emptied crypto wallets within minutes.
How the Money Returned to India
ED’s money-laundering probe shows that the stolen cryptocurrency was liquidated through peer-to-peer (P2P) trades on various platforms. The proceeds were then channelled into India and deposited into accounts controlled by: Chirag Tomar, Rahul Anand, Aakash Vaish, Piyush Prashar, and others. The funds were subsequently used to purchase real estate across north India. Properties identified and attached include flats, plots, agricultural and non-agricultural land and commercial units.
Cybercrime Expert Prof. Triveni Singh Sounds an Alarm
Renowned cybercrime expert and former IPS officer Professor Triveni Singh described the case as a “textbook example” of how global fraud networks now exploit search engines to trap victims.
In his words:
“SEO-driven cyber fraud is becoming one of the most dangerous trends. People trust top search results blindly. Criminals exploit this behaviour by pushing fake websites above genuine ones. Every investor must manually type URLs and avoid clicking on search-listed links while accessing financial platforms.”
Prof. Singh added that cybercrime syndicates are evolving rapidly, and enforcement agencies will have to upgrade their technical capabilities in the same proportion.
US Arrest Leads to Indian Investigation
Chirag Tomar was detained by US authorities in December 2023 when he attempted to enter the United States. Investigators there uncovered evidence showing that Tomar and his associates had targeted hundreds of foreign nationals through fake portals and call-centre operations.
ED’s investigation in India began soon after, focusing on the money trail and property purchases made using the laundered funds. The agency is also analysing several cryptocurrency wallets, P2P trades, and transactions conducted through offshore exchanges.
More Action Likely as Probe Enters Final Phase
Sources indicate that ED is scrutinising the role of at least two more individuals suspected of handling overseas crypto sales and coordinating the flow of funds back into India. If their involvement is confirmed, the agency may file additional charges under the Prevention of Money Laundering Act (PMLA) and relevant cyber fraud provisions. Officials described the network as “one of the most sophisticated SEO-driven crypto fraud modules” uncovered in recent years.
