Fake Coinbase: how it was born and who is the creator

An Indian national has pleaded guilty in the United States to charges of stealing more than $37 million by creating a website that mimicked cryptocurrency trading platform Coinbase, essentially creating a fake Coinbase.

Chirag Tomar, 30, pleaded guilty to wire fraud conspiracy for defrauding multiple people in a cryptocurrency scam using a phony Coinbase, which carries a maximum sentence of 20 years in prison and a $250,000 fine. He was arrested on December 20, 2023, upon his entry into the country.

“Tomar and his co-conspirators (fake Coinbase accomplices) organized a scheme to steal millions of cryptocurrencies from hundreds of victims around the world and in the United States, including in the Western District of North Carolina,” the Department of Justice (DoJ) said last week.

The website, created around June 2021, was called “CoinbasePro(.)com” (basically the fake Coinbase, it made unfortunate people believe that it was a sort of “pro” version of the real one) in an attempt to disguise itself as Coinbase Pro and trick unsuspecting users into believing they are accessing the legitimate version of the virtual currency trading platform.

It is worth noting that Coinbase discontinued the offering in favor of Advanced Trade in June 2022; and this was to further imply that CoinbasePro was the fake Coinbase, the gradual migration of Coinbase Pro customers to Coinbase Advanced was completed on November 20, 2023.

Victims who entered credentials on the fake Coinbase site had their login information stolen by scammers and, in some cases, were tricked into granting remote desktop access which allowed the cyber criminals to access their Legitimate Coinbase accounts.

“The scammers also impersonated Coinbase customer service representatives and tricked users into providing their two-factor authentication codes to the scammers over the phone,” the DoJ said, adding: “Once the scammers gained access to the victims’ Coinbase accounts, they quickly transferred the victims’ cryptocurrencies to the cryptocurrency wallets under the scammers’ control.”

In one case highlighted by prosecutors, an unidentified fake Coinbase victim located in the Western District of North Carolina lost over $240,000 in cryptocurrency this way after being tricked into calling a fake Coinbase representative under the guise of blocking their trading accounts.

Tomar is believed to have been in possession of several cryptocurrency wallets that received stolen funds totaling tens of millions of dollars, which were later converted into other forms of cryptocurrency or transferred to other wallets and ultimately cashed out to fund a style of luxurious life.

This included expensive watches from brands such as Rolex, the purchase of luxury vehicles such as Lamborghini and Porsche, and several trips to Dubai and Thailand.

The development in the investigation into the fake Coinbase comes as a Special Investigation Team (SIT) associated with the Criminal Investigation Department (CID) in the Indian state of Karnataka arrested Srikrishna Ramesh (also known as Sriki) and his alleged accomplice Robin Khandelwal for the theft of 60.6 bitcoins from a cryptocurrency exchange company called Unocoin in 2017.

It was thus discovered where the money went, after it passed through the fake Coinbase.

The Coinbase clone (the fake Coinbase) is just the tip of the Iceberg that started a series of events.

The phony Coinbase case also follows a new wave of arrests in the United States in connection with an elaborate, multi-year scheme designed to help North Korea-linked IT workers obtain remote jobs at more than 300 U.S. companies and advance the the country's weapons of mass destruction in violation of international sanctions.

Among the arrested parties is a 27-year-old Ukrainian citizen, Oleksandr Didenko, accused of creating fake accounts on IT job search platforms in the United States and selling them to foreign IT workers to obtain employment.

He is also believed to have operated a now-dismantled service called UpWorkSell that advertised the “ability for remote IT workers to purchase or rent accounts in the names of identities other than their own on various online freelance IT job search platforms.”

According to the affidavit in support of the complaint, Didenko operated approximately 871 “proxy” identities, provided proxy accounts for three freelance IT hiring platforms in the United States, and provided proxy accounts for three different U.S.-based money services transmitters.

Those involved are not just North Koreans

Didenko's accomplice, Christina Marie Chapman, 49, was also arrested for running what is called a “laptop farm” by hosting multiple laptops at her residence for North Korean IT workers to give the impression they were in the U.S. and apply for remote work positions in the country.

“The conspiracy (…) generated at least $6.8 million in revenue for foreign IT workers,” Chapman's indictment said, adding that the workers obtained jobs at numerous prominent U.S. companies and exfiltrated data from at least two of them, including