Korvio Coin ED Raids: Rs 500 Crore Crypto Fraud Explained

India's Enforcement Directorate has made a fresh arrest in one of the country's largest alleged crypto fraud cases. On 31 October 2026, the agency said it had arrested Atul Sood, described as a close aide of alleged mastermind Subhash Sharma, during searches across Chandigarh, Mohali and Zirakpur in connection with the alleged Rs 500 crore Korvio Coin fraud. The ED says more than 2.48 lakh users were affected, with transactions exceeding $219 million, and that the scheme promised assured high returns through a multi-level marketing model that worked like a Ponzi operation.

This Korvio Coin ED raids case matters for beginners for a simple reason: it is not a story about a complicated hack or a failed exchange. It is a story about a familiar sales pitch — guaranteed returns, a new coin, and rewards for bringing in friends — that investigators say hid an old fraud behind new technology. This guide explains what the ED has alleged, how the case has unfolded over three rounds of raids, what the arrests so far mean, and, most importantly, the red flags that would have marked this kind of scheme from the start.

> Educational content only. This is not financial advice. Crypto markets are volatile — never invest money you can't afford to lose. This article reports allegations made by investigators as reported in the press; the people named are accused, not convicted, and the case is ongoing.

What the ED Says Happened

According to the ED's statement, issued on 31 October 2026 and carried the same day by The Times of India, The Statesman, UNI, The Hawk, Yes Punjab and NationPress, the case began with FIRs registered by the Himachal Pradesh and Punjab Police against Subhash Sharma and others. On the basis of those FIRs, the ED opened a money-laundering investigation under the Prevention of Money Laundering Act (PMLA), 2002.

The agency's account is that Sharma, together with associates including Hem Raj, Sukhdev Thakur, Abhishek Sharma and others, operated a cryptocurrency-based multi-level marketing (MLM) scheme through an online platform. Investors were, the ED says, induced to put money into Korvio Coin (KRO) — a coin the agency describes as fictitious — by promises of assured high returns. The scheme allegedly functioned on a Ponzi model: funds received from new investors were used to pay earlier investors, rather than being generated by any genuine investment activity.

The scale the ED describes is large. Recovered digital data, the agency says, indicated that more than 2.48 lakh users were affected, with transactions exceeding $219 million and estimated investor losses of around Rs 500 crore. The ED also alleges that most funds were collected in cash and routed through team leaders to Sharma and his associates, including Vijay Kumar Juneja and Masoom Juneja, and that substantial funds were diverted into property purchases and other financial transactions.

It is important to be precise about what this is and is not. Everything in this section is the ED's allegation, as reported in the press. A charge sheet has been filed, which means the agency has formally put its case before a court, but a charge sheet is not a conviction. The accused are entitled to defend themselves, and the courts will decide the facts. For readers, the value of the case is not in prejudging the outcome, but in understanding the pattern the investigators describe — because that pattern repeats, with different coin names, again and again.

Three Rounds of Raids: How the Case Built Up

The 28 October searches were not the first step in this investigation. They were the third round, and the timeline shows how a case like this typically develops.

The first searches took place on 13 December 2025, and the second on 15 June 2026, at premises linked to individuals associated with the alleged scheme. Those two rounds resulted in the seizure of documents, digital devices and movable assets valued at approximately Rs 1.5 crore. Five associates of Sharma — Hem Raj, Sukhdev Thakur, Abhishek Sharma, Milan Garg and Masoom Juneja — had previously been arrested in connection with the case, and the ED has filed a charge sheet along with a supplementary charge sheet against them before the Special Court in Shimla.

The latest round, on 28 October 2026, was carried out by the ED's Shimla Sub-Zonal Office under Section 17(1) of the PMLA, which covers search and seizure powers. Searches across Chandigarh, Mohali and Zirakpur led to the seizure of property-related documents, multiple digital devices, bank account records and Rs 72 lakh in cash. During the operation, the ED arrested Atul Sood.

The agency says Sood was a close aide of Sharma who travelled to Dubai to meet him and was involved in arranging conferences and other events for him, even after FIRs had been registered in connection with the alleged fraud. Sood was produced before the Special PMLA Court in Shimla on 29 October, which granted the ED his custody until 5 November. The agency says it is examining the seized material to establish the movement of funds and identify assets allegedly acquired using investors' money.

One detail in the reporting stands out: Sharma himself is believed to be sheltering in Dubai and remains at large, according to press coverage of the case. That is a common feature of large alleged MLM frauds — the public-facing events and recruitment happen in India, while the person at the top is outside the country, which makes recovery of funds harder and slower. It is also why the ED's focus in the latest raids was partly on documents and devices that might trace where money went, rather than only on cash seized on the day.

Why This Case Is Different From the Other ED Crypto Story

Readers who follow Indian crypto news may feel they have already read an ED story this week. On 27 October, the ED searched premises in Bengaluru and Madhya Pradesh over alleged unauthorised cross-border crypto transfers worth thousands of crores, involving foreign platforms and alleged FEMA contraventions. That story was covered in our earlier guide on the ED searches and FEMA.

The Korvio Coin case is a different investigation with a different shape. The October FEMA story was about alleged cross-border movement of funds through platforms and whether foreign-exchange rules were followed. The Korvio case is about an alleged domestic MLM-Ponzi scheme built around a single coin, with recruitment through team leaders and conferences, cash collections, and promises of assured returns to ordinary investors. The agencies, laws and questions involved overlap — both cases involve the PMLA and the ED — but the fraud pattern, the victims and the lessons are different. That is why it deserves its own explanation rather than being folded into the earlier story.

There is also a broader point. In the same week, India has seen a record exchange security incident at Binance, a new self-regulatory body for Web3 companies, and now a major alleged Ponzi prosecution. These are not the same kind of event, and they should not be confused with each other: an exchange being hacked is not the same as an exchange committing fraud, and a regulator investigating a scheme is not the same as a regulator banning crypto. Keeping the categories separate is the first step to reading crypto news calmly instead of panicking at every headline.

The Ponzi Pattern, in Plain Language

A Ponzi scheme is named after Charles Ponzi, who ran one in Boston in 1920, but the structure has barely changed in a century. It works like this. A promoter offers unusually high returns with little or no risk. Early investors are paid — not from profits, because there are none, but from money put in by newer investors. Those early payouts become the best advertising the scheme has: real people, telling friends and family, showing real money received. Recruitment accelerates. As long as new money keeps flowing in faster than payouts go out, the scheme looks successful. The moment recruitment slows, or too many people ask for their money back at once, the gap becomes visible and the scheme collapses.

A multi-level marketing layer makes the pattern harder to see. In a genuine MLM business, participants earn mainly by selling a real product to real customers outside the network. In a Ponzi-style MLM, the "product" is often vague — a coin, a package, a membership — and the real income comes from recruiting new participants, whose joining fees fund the payouts above them. Conferences, stage events, luxury imagery and team hierarchies ("team leaders") all serve the same purpose: they make recruitment feel like a career and a community, rather than what it functionally is, which is the fuel supply for payouts.

Cryptocurrency adds three things to this old pattern. First, a new coin gives the scheme a modern story: early buyers are told they are getting in before the price rises, which makes the promise of returns feel technical rather than magical. Second, crypto transfers can be harder for an ordinary person to trace than a bank transfer, which makes it easier for organisers to move money and harder for victims to follow it. Third, crypto's genuine volatility gives promoters cover: when prices move sharply, a scheme's promised returns can be blamed on, or credited to, "the market" rather than to recruitment. None of this means crypto itself is a Ponzi scheme — Bitcoin, Ethereum and other established networks are not run by a promoter paying old investors from new money. It means crypto is a convenient costume for a Ponzi scheme to wear, and beginners need to look past the costume at the underlying structure.

Seven Red Flags This Case Illustrates

The Korvio allegations, as reported, contain almost every classic warning sign. Learning to spot them is worth more than memorising any single coin's name, because the next scheme will use a different one.

1. Assured or guaranteed high returns. No genuine investment can promise assured returns, and crypto returns are especially uncertain. Any pitch that guarantees a fixed monthly percentage, or promises that you "cannot lose", is making a claim that no honest operator can make. Genuine returns always come with stated risk, and the higher the promised return, the higher the risk should be.

2. Returns that depend on recruitment. If the main way to earn is to bring in new members, and those members' money funds your payout, the structure is a Ponzi pattern regardless of what the product is called. Ask one question: if nobody new joined tomorrow, where would my returns come from? If there is no convincing answer, walk away.

3. A vague or unverifiable product. A genuine crypto project can explain, in plain language, what its token does, who uses it, and where its value comes from — and that explanation can be checked against public code, a real user base and independent reporting. A coin whose only story is its price, its "upcoming listing" or its promoter's lifestyle is not a product; it is a pitch.

4. Cash collections through intermediaries. The ED alleges that funds in this case were mostly collected in cash and routed through team leaders. Cash routed through individuals, rather than through a traceable payment to a registered entity with receipts, is a serious warning sign in any investment, crypto or otherwise. Traceable payments protect you; untraceable ones protect the organiser.

5. Pressure, urgency and community hype. Conferences, countdowns, "last chance" joining windows and social pressure from friends or family who have already joined are sales techniques, not evidence. A genuine investment opportunity will still be there after a night's sleep and a check with an independent source. A scheme often will not want you to take that night.

6. A promoter who cannot be checked. When the person at the top is abroad, unreachable, or known only through stage appearances and social media, accountability is weak. Before trusting anyone with money, check whether they and their company are identifiable, registered where they claim to be, and subject to any regulator's oversight. In India, virtual digital asset service providers covered by the rules must register with the Financial Intelligence Unit-India (FIU-IND) and meet reporting and customer due diligence obligations — a basic check that takes minutes.

7. Requests for keys, passwords or "verification" payments. No genuine project needs your seed phrase or private keys, and no genuine withdrawal requires you to send funds to a new address first. Any message asking for either is a scam by definition, whatever brand name it uses.

What To Do If You Think You Were Affected

If you, or someone you know, put money into a scheme like the one alleged here, the steps below are practical, not legal advice, and they should be taken calmly and in writing.

First, preserve everything: receipts, bank statements, UPI transaction records, chat messages, event invitations, and any record of who collected the money and when. Do not delete chats or hand your phone to anyone promising to "recover" funds. Second, consider reporting to the local police and to the cybercrime reporting portal (cybercrime.gov.in), and keep copies of any complaint reference numbers. Third, be extremely wary of "recovery" services that contact victims after a fraud becomes public — they are a well-known second fraud, charging an upfront fee to recover money that is rarely recoverable by them. Fourth, do not let embarrassment stop you from telling family or seeking advice; these schemes are designed to exploit trust and social networks, and victims include careful, educated people.

On tax, keep records even for losses: dates, amounts in INR, the platform or person involved, and any correspondence. Tax note: crypto tax rules can change — the 30% rate and 1% TDS described here were current as of September 2026. Verify the latest rules before filing. If you sold crypto on an Indian exchange in connection with such a scheme, the tax treatment of the sale and of any loss may differ, so keep the paperwork and check the current rules rather than guessing.

Finally, talk about it. The single most effective protection against the next scheme is a person who has seen one up close telling others what it looked like. If a friend pitches you a coin with guaranteed returns and a recruitment bonus, the story of Korvio Coin — as alleged by investigators — is a concrete example to point to, not an abstract warning.

Frequently Asked Questions

What is the Korvio Coin case the ED is investigating?

According to the Enforcement Directorate, Korvio Coin (KRO) was at the centre of an alleged cryptocurrency-based multi-level marketing scheme run through an online platform. The agency says the alleged mastermind, Subhash Sharma, and his associates induced people to invest in Korvio Coin by promising assured high returns, and that the scheme worked like a Ponzi operation, using money from new investors to pay earlier ones. The ED puts estimated investor losses at around Rs 500 crore, with more than 2.48 lakh users affected and transactions exceeding $219 million. These are allegations under investigation, not court findings, and the case is ongoing.

Who was arrested in the latest ED raids?

During searches on 28 October 2026 across Chandigarh, Mohali and Zirakpur, the ED's Shimla Sub-Zonal Office arrested Atul Sood, described as a close aide of alleged mastermind Subhash Sharma. Sood was produced before the Special PMLA Court in Shimla on 29 October and remanded to ED custody until 5 November. The agency says Sood travelled to Dubai to meet Sharma and helped organise conferences and events for him even after police FIRs had been registered. Five other associates had previously been arrested in the same case, and a charge sheet and a supplementary charge sheet have been filed before the Special Court in Shimla.

How can a beginner tell a genuine crypto project from a Ponzi-style scheme?

The single strongest warning sign is a promise of assured or guaranteed high returns, because no genuine investment can promise that. Other red flags include pressure to recruit new members to earn, vague explanations of where returns come from, bonuses paid mainly for bringing in others rather than for any real product, and requests for cash payments routed through team leaders instead of transparent, traceable channels. A genuine project can explain its product in plain language, does not need your recruitment to survive, and never asks you to hand over your seed phrase or private keys.

The Bottom Line

The Korvio Coin case, as alleged by the ED, is a reminder that the most dangerous crypto frauds rarely look technical. They look social: a trusted friend, a packed conference, a coin with a bright future, and a return that seems too good to question. The numbers attached to this case — around Rs 500 crore in estimated losses, more than 2.48 lakh users affected, Rs 72 lakh seized in the latest raids, and custody until 5 November for the latest arrest — describe the scale of what happens when that pitch works.

For Indian beginners, the lesson is not to fear crypto, but to apply one habit before any crypto decision: ask where the returns come from, and demand an answer that does not depend on new people joining. If the answer is guaranteed returns, recruitment bonuses, or a product nobody can explain, the right move is the simplest one — walk away, keep your records, and tell someone else what you saw. That habit, repeated across thousands of readers, is what stops the next Korvio Coin before it starts.

Keep Learning

• How to Spot a Crypto Ponzi Scheme: Red Flags for Indian Beginners
• ED Crypto Searches and FEMA: What Indian Users Should Know
• 7 Common Crypto Scams Targeting Indians (And How to Avoid Them)