Kippes v. John Does 1-25

Opinion

1 2 3 6 7 PATRICK KIPPES, Case No. 25-cv-03616-SVK

8 Plaintiff, ORDER ON PLAINTIFF'S EX PARTE APPLICATION TO SERVE THIRD- 9 v. PARTY SUBPOENAS PRIOR TO A RULE 26(F) CONFERENCE 10 DOES 1-25, Re: Dkt. No. 13 11 Defendant.

12 Plaintiff Patrick Kippes alleges that he lost approximately $200,000 in cryptocurrency as 13 the result of a financial scam in which he was misled into trading on a fake cryptocurrency 14 exchange. See Dkt. 11 (First Amended Complaint). Plaintiff claims that he does not know the identities of the Doe Defendants, who are “persons and entities who contacted Plaintiff using an 15 alias, set up and ran the fake exchange, communicated with Plaintiff through a fake website, and 16 refused to release his deposits.” Id. ¶ 7. Now before the Court is Plaintiff’s ex parte application 17 for leave to serve subpoenas on a number of third parties in an attempt to ascertain the identity of 18 the Doe Defendants. Dkt. 13. This matter is suitable for determination without a hearing. 19 Civ. L.R. 7-1(b). For the reasons that follow, the Court GRANTS IN PART Plaintiff’s leave to 20 serve third-party subpoenas. Plaintiff may serve subpoenas on the entities identified in his motion, 21 but the subpoenas must be limited to seeking certain account holder and account balance 22 information and must give the subpoena recipients an opportunity to object to or move to quash or 23 modify the subpoenas. 24 I. BACKGROUND1 25 In late 2024, Plaintiff, who resides in this District, was contacted through LinkedIn by 26 someone who identified themselves as “Vicky Wang,” who claimed to be a financial executive for 27 1 Southwest Airlines and BlackRock Financial. Dkt. 11 ¶¶ 17, 20, 21; Dkt. 13-2 ¶ 4. Wang also 2 contacted Plaintiff through Plaintiff’s WhatsApp and iMessage accounts. Dkt. 11 ¶ 22; Dkt. 13-2 3 ¶¶ 5-7. After about four months of attempted communications from Wang, Plaintiff responded. Dkt. 11 ¶ 23; Dkt. 13-2 ¶ 8. Wang discussed with Plaintiff using centralized “Web 3.0” platforms 4 to earn returns on trading cryptocurrency and provided screenshots of her portfolio showing high 5 returns. Dkt. 11¶¶ 24-25; Dkt. 13-2 ¶ 10. 6 In February 2025, Plaintiff decided to try some trades, and Wang directed Plaintiff to a 7 trading platform called “Raydium Pro,” which Plaintiff claims he believed was associated with the 8 legitimate exchange Raydium.io. Dkt. 11 ¶¶ 26-28; Dkt. 13-2 ¶ 12. Between February 12, 2025 9 and February 27, 2025, as directed by Wang, Plaintiff deposited 1.649644284 Bitcoin to two 10 addresses on the bitcoin blockchain: 3AsBsxRhhftwXDTKRmKYCjYsJFq1HPYUc1 and 11 3JCD69qMZiKKX6PQ15Vx2NTPJTd9AU4vtR. Dkt. 11 ¶ 29; Dkt. 13-2 ¶ 14. On February 26, 12 2025, Plaintiff was able to withdraw $490 from his account. Dkt. 11 ¶ 30; Dkt. 13-2 ¶ 15. In that 13 timeframe, Plaintiff was also able to access records on the allegedly fake exchange site that 14 showed his investment was growing. Dkt. 11 ¶ 31; Dkt. 13-2 ¶ 17. On March 2, 2025, Plaintiff 15 deposited 62,067.96 USDC, another form of cryptocurrency, to an address on the Ethereum 16 blockchain: 0x2eAb6129aFf80e301A52432bf6f8a010b3d7760e. Dkt. 11 ¶ 34; Dkt. 13-2 ¶ 16. 17 On March 1, 2025, Plaintiff tried to withdraw approximately $342,000 of his digital assets, 18 but his account showed the transaction was “under review.” Dkt. 11 ¶¶ 32-33; Dkt. 13-2 ¶ 18. Plaintiff was informed by the exchange that he would have to deposit additional funds to proceed 19 with his withdrawal. Dkt. 11 ¶ 35; Dkt. 13-2 ¶ 19. At this point, Plaintiff realized he had been the 20 victim of a fraud. Dkt. 11 ¶ 36; Dkt. 13-2 ¶ 20. 21 Plaintiff retained a company that tracks digital assets to help him recover his 22 cryptocurrency. Dkt. 11 ¶ 37; Dkt. 13-1 ¶ 21; see also Dkt. 13-4. The company concluded that 23 Plaintiff’s assets had been moved through numerous accounts (the “Destination Addresses”) on 24 cryptocurrency exchanges Coinbase, Kraken, Crypto.com, HitBtc, and Changelly (the 25 “Virtual Asset Service Providers” or “VSAPs”). Dkt. 11 ¶ 38; see also Dkt. 13-4 ¶¶ 13-24. 26 On April 24, 2025, Plaintiff filed the original complaint in this action. Dkt. 1. On May 28, 27 2025, the Court issued an Order to Show Cause that required Plaintiff to demonstrate that this 1 Complaint, which contains additional information about the citizenship of the Parties and the 2 amount in controversy, and the Court discharged the Order to Show Cause. Dkt. 11, 12. 3 The First Amended Complaint contains several causes of action including fraud, conversion, money had and received, unjust enrichment, and constructive trust. Dkt. 11. 4 Federal Rule of Civil Procedure Rule 26(d) provides that absent a court order, no discovery 6 can be sought “from any source before the parties have conferred as required by Rule 26(f).” 7 Fed. R. Civ. P. 26(d)(1). District courts within the Ninth Circuit generally require a showing of 8 good cause for early discovery. See Strobel v. Lesnick, No. 21-cv-01010-LB, 2021 WL 5121171, 9 at *2 (N.D. Cal. Nov. 1, 2021) (collecting cases). “Good cause may be found where the need for 10 expedited discovery, in consideration of the administration of justice, outweighs the prejudice to 11 the responding party.” Semitool, Inc. v. Tokyo Electron Am., Inc., 208 F.R.D. 273, 276 (N.D. Cal. 12 2002). In determining whether good cause exists, courts consider: “(1) whether a preliminary 13 injunction is pending; (2) the breadth of the discovery request; (3) the purpose for requesting the 14 expedited discovery; (4) the burden on the defendants to comply with the requests; and (5) how far 15 in advance of the typical discovery process the request was made.” Rovio Ent. Ltd. v. Royal Plush 16 Toys, Inc., 907 F. Supp. 2d 1086, 1099 (N.D. Cal. 2012). 17 Under appropriate circumstances, California district courts have found good cause to 18 authorize early discovery to ascertain the identity of an unknown defendant. See, e.g., JustM2J 19 LLC v. Brewer, No. 2:25-cv-00380-DAD-SCR, 2025 WL 435827, at *10-11 (E.D. Cal. Feb. 7, 2025) (authorizing early third-party subpoenas to identify the identity of Doe defendants in a case 20 alleging that cryptocurrency assets were lost as a result of cyberattacks); AF Holdings LLC v. Doe, 21 No. 2:12-cv-02207-KJM-DAD, 2012 WL 6608993, at *1 (E.D. Cal. Dec. 18, 2012) (granting 22 leave to conduct expedited discovery to determine the identity of a Doe defendant in a copyright 23 infringement action); First Time Videos, LLC v. Doe, No. 2:12- cv-00621-GEB-EFB, 2012 WL 24 1355725 (E.D. Cal. Apr. 18, 2012) (same); UMG Recordings, Inc. v. Doe, No. 08-cv-03999- 25 RMW, 2008 WL 4104207 (N.D. Cal. Sept. 4, 2008) (same); Arista Recs. LLC v. Does 1– 43, No. 26 07-cv-02357-LAB-POR, 2007 WL 4538697 (S.D. Cal. Dec. 20, 2007) (same). Moreover, the 27 Ninth Circuit has held that “‘where the identity of the alleged defendant[ ] [is] not [ ] known prior 1 identify the unknown defendants, unless it is clear that discovery would not uncover the identities, 2 or that the complaint would be dismissed on other grounds.’” Wakefield v. Thompson, 177 F.3d 3 1160, 1163 (9th Cir. 1999) (alteration in original) (quoting Gillespie v. Civiletti, 629 F.2d 637, 642 (9th Cir. 1980)). 4 To determine whether a plaintiff has established good cause to seek the identity of a Doe 5 defendant through early discovery, courts consider whether the plaintiff (1) identifies the Doe 6 defendant with sufficient specificity that the Court can determine that the defendant is a real 7 person who can be sued in federal court, (2) recounts the steps taken to locate and identify the 8 defendant, (3) demonstrates that the action can withstand a motion to dismiss, and (4) shows that 9 the discovery is likely to lead to identifying information that will permit service of process. 10 Columbia Ins. Co. v. seescandy.com, 185 F.R.D. 573, 578–80 (N.D. Cal. 1999); see also Strobel, 11 2021 WL 5121171, at *2. 12 III. DISCUSSION 13 Plaintiff’s present motion for leave to serve third-party subpoenas prior to a Rule 26(f) 14 conference seeks leave to serve subpoenas on the following categories of third parties in an effort 15 to identify the Doe Defendants: (1) virtual asset service providers Coinbase, Kraken, Crypto.com, 16 HitBtc, and Changelly (collectively, the “VSAPs”) associated with the Destination Addresses to 17 which the asset recovery company retained by Plaintiff has traced the assets deposited by Plaintiff; 18 (2) social media and messaging platforms LinkedIn, WhatsApp, and iMessage (Apple), through 19 which “Vicky Wang” contacted Plaintiff (collectively, the “Social Media/Networking Platforms”); and Internet Service Providers Bandwith.com and T-Mobile (collectively, the “ISPs”), which are 20 associated with the telephone numbers used by “Vicky Wang” to communicate with Plaintiff. 21 Dkt. 13; Dkt. 13-1; Dkt. 13-2; Dkt. 13-4. 22 In considering whether Plaintiff has established good cause to conduct this early discovery 23 under the relevant Rovio factors, the Court concludes that good cause exists for Plaintiff to serve 24 subpoenas on each category of third parties but that the scope of information Plaintiff seeks to 25 obtain is overly broad. 26 A. Whether a preliminary injunction is pending 27 Plaintiff has not yet filed a motion for preliminary injunction. However, Plaintiff has 1 adequately shown that he needs additional information about the identity of the Doe Defendants to 2 establish the factors that would support a motion for a temporary restraining order or preliminary 3 injunction. See Dkt. 13 at 7. 4 B. Purpose for the requested discovery The purpose for requesting early discovery is an attempt by Plaintiff to identify the 5 unknown defendants. As explained in section II above, to determine whether a plaintiff has 6 established good cause to seek the identity of an unknown defendant through early discovery, 7 courts consider the seescandy.com factors. See JustM2J, 2025 WL 435827, at *10. Here, Plaintiff 8 retained a cryptocurrency investigator in an effort to trace the assets deposited by Plaintiff. 9 See Jacobo v. Doe, No. 1:22-cv-00672-DAD-BAK (BAM), 2022 WL 2079766, at *3 (E.D. Cal. 10 June 9, 2022) (“Jacobo II”) (finding first seescandy.com element met where plaintiff “recounts the 11 use of blockchain analytics to trace the path of her stolen assets and identified a number of 12 cryptocurrency wallet addresses (‘Destination Addresses’) at the Exchanges to which her assets 13 have been transferred without her consent”). Plaintiff’s communications with “Vicky Wang” 14 indicate that the identity of the Doe Defendant to whom Plaintiff transferred cryptocurrency assets 15 “is likely already known or ascertainable.” See Jacobo II, 2022 WL 2079766, at *3. Moreover, 16 through Plaintiff’s effort to trace his cryptocurrency assets, Plaintiff has identified specific wallet 17 addresses held by specific VSAPs, which should enable the identification of additional Doe 18 Defendants. See generally Dkt. 13-4. The information Plaintiff seeks regarding ownership of 19 these accounts “is reasonably likely to lead to the production of information that will permit plaintiff to serve process.” Jacobo II, 2022 WL 2079766, at *3. Plaintiff has also demonstrated 20 that the action can withstand a motion to dismiss. See generally Jacobo v. Doe, No. 1:22-cv- 21 00672-DAD-BAK (BAM), 2022 WL 2052636, at *4-5 (E.D. Cal. June 7, 2022) (“Jacobo I”) (on 22 motion for temporary restraining order, finding that alleged victim of similar cryptocurrency scam 23 was likely to succeed on the merits of conversion claim); Jacobo II, 2022 WL 2079766, at *3 (on 24 motion for expedited discovery, finding that likelihood of success on conversion claim satisfied 25 seescandy.com criteria). Accordingly, the third Rovio factor, which considers the purpose for 26 requesting early discovery, supports a finding of good cause because early discovery is an 27 appropriate method of attempting to identify unknown defendants where, as here, the C. Burden on defendants 1 The discovery sought by Plaintiff will not impose a burden on the Doe Defendants because 2 at this juncture the Court is only authorizing Plaintiff to serve subpoenas on the third-party 3 VSAPs, Social Media/Messaging Platforms, and ISPs. Moreover, the Court’s order will ensure 4 that the return date on the subpoenas will give the subpoena recipients an opportunity to object to 5 or file a motion to quash or modify the subpoenas and therefore gives them an opportunity to raise 6 any issues regarding the burden imposed by the subpoenas. See JustM2J, 2025 WL 435827, 7 at *10. 8 D. Timing of request for early discovery 9 Plaintiff’s request to conduct early discovery does not raise any concerns under the Rovio 10 factor that considers how far in advance of the typical discovery process the request was made. 11 Plaintiff made the request early in the litigation. As a practical matter, this case cannot proceed to 12 a Rule 26(f) conference until the Doe Defendants are identified, added to the case, served, and appear. 13 14 E. Breadth of discovery The remaining Rovio factor considers the breadth of the discovery request. In an effort to 15 identify the account holder(s) of each of the VSAP accounts identified by the asset recovery 16 company retained by Plaintiff and the social media accounts, messaging accounts, and telephone 17 numbers through which “Vicky Wang” contacted Plaintiff, Plaintiff appropriately seeks the 18 account holders’ name, address, phone number, and email address. See Dkt. 13-3 ¶ 2; see also 19 Dkt. 13-1; Dkt. 13-2; Dkt. 13-4. Plaintiff has not at this time demonstrated good cause for his 20 request to seek additional account holder information, such as “know your customer (KYC) and 21 anti-money laundering (AML) information” from the VSAPs, “device identifiers and 22 registrations” from the Social Media/Messaging Platforms, or “device identifiers” from the ISPs. 23 See Dkt. 13-3 (Plaintiff’s proposed order) ¶¶ 2, 5, 7. 24 Plaintiff also has not at this time demonstrated good cause to seek all “transaction records 25 of deposits and withdrawals” from the VSAPs, “network and access logs” and” from the Social 26 Media/Messaging Platforms, or “network and access logs” and from the ISPs. See id. Other 27 district courts in the Ninth Circuit have “declined to broaden the scope of expedited discovery to 1 asset dissipation.” JustM2J, 2025 WL 435827, at *11 (collecting cases); see also Rambod v. 2 Defendant 1, No. 2:24-cv-07215-SVW-BFM, 2024 WL 5673308, at *3 (C.D. Cal. Nov. 5, 2024) 3 (authorizing subpoena seeking names and physical addresses of account holders but not other identifying information or transaction or account balance information); Jacobo II, 2022 WL 4 2079766, at *4 (finding that plaintiff failed to narrowly tailor expedited discovery requests where 5 requests sought information beyond information about account owner, such as information 6 regarding transactions involving the accounts). The Court agrees with this distinction and denies 7 Plaintiff’s attempt to seek general transaction information and network and access logs at this 8 time. See Dkt. 13 at 11-12; Dkt. 13-3 ¶ 8. This limitation is especially appropriate in light of 9 Plaintiff’s request that the subpoena recipients be prohibited from notifying the account holders of 10 the subpoenas, which will prevent the account holders from objecting to Plaintiff’s request for 11 transaction information. 12 Although the Court will not allow Plaintiff to seek general transaction information at this 13 time, the Court will permit Plaintiff to ask for the balances of the VSAP accounts identified in his 14 motion. District courts within the Ninth Circuit have reached different results on the issue of 15 whether subpoenas aimed at identifying unknown defendants involved in cryptocurrency scams 16 should be allowed to seek information about account balances. Compare Salem v. Defendant “1,” 17 No. 2:24-cv-07079-JAK (RAOx), 2025 WL 1039396, at *1 (C.D. Cal. Jan. 22, 2025) (authorizing 18 subpoenas to cryptocurrency exchanges that sought account balances) with Rambod, 2024 WL 5673308, at *3 (declining to authorize portion of proposed subpoenas to cryptocurrency exchanges 19 that sought account balances). More generally, however, courts in other cases have recognized 20 that cryptocurrency like that at issue in this case “poses a heightened risk of asset dissipation.” 21 JustM2J, 2025 WL 435827, at *6 (citations omitted); see also Jacobo I, 2022 WL 2052637, at 22 *10-11 (granting temporary restraining order, finding that “the fact that the assets at issue here are 23 held in cryptocurrency weigh in favor the granting of injunctive relief and a freezing of the assets 24 because there is a high risk of asset depreciation with cryptocurrency” (citation omitted)). 25 These courts have signaled that whether a defendant has begun liquidating cryptocurrency assets is 26 relevant to whether the plaintiff is entitled to a temporary restraining order. JustM2J, 2025 WL 27 435827, at *9 (denying temporary restraining order and distinguishing Jacobo I on the issue of 1 liquidating cryptocurrency assets”). Allowing Plaintiff to obtain information about the balances of 2 the identified cryptocurrency accounts, while also precluding Plaintiff from seeking more detailed 3 transaction information at this time, strikes the appropriate balance between Plaintiff’s need for information in connection with his stated intention to seek asset-freezing injunctive relief (see 4 Dkt. 13 at 12) and any prejudice to the Doe Defendants. 5 F. Conclusion on Rovio factors 6 After considering the relevant factors, the Court finds good cause to permit Plaintiff to 7 serve subpoenas on the third-party VSAPs, Social Media/Messaging Platforms, and ISPs that are 8 limited to seeking basic identifying information regarding holders of the relevant accounts and the 9 account balances of the accounts identified in Plaintiff’s motion and that comply with the 10 additional requirements set forth below. 11 G. Notice to Doe Defendants 12 Plaintiff requests that if the Court authorizes the issuance of subpoenas, the Court order 13 that the subpoena recipients (i.e., the third-party VSAPs, Social Media/Messaging Platforms, and 14 ISPs identified in Plaintiff’s motion) refrain from notifying their customers (i.e., account 15 holders/users) about the subpoenas, citing two cases in which Plaintiff claims courts have issued 16 temporary restraining orders on an ex parte basis because of the risk that cryptocurrency assets 17 could be dissipated. Dkt. 13 at 11-12.2 Most courts that have authorized early discovery in an 18 effort to identify Doe defendants in cryptocurrency cases have required cryptocurrency exchanges 19 to notify their account holders/users of the subpoenas. See, e.g., JustM2J, 2025 WL 435827, at 20 *11; Jacobo II, 2022 WL 2079766, at *4; ZG TOP Tech. Co. Ltd. v. Doe, No. C19-92-RAJ, 2019 WL 917418, at *2 (W.D. Wash. Feb. 25, 2019). However, because of the concerns discussed in 21 section III.E. about the possible risk of asset dissipation before Plaintiff is in the position to bring a 22 motion for temporary restraining order and because the Court has narrowed the scope of 23 information Plaintiff is authorized to seek by the subpoenas, the Court will grant Plaintiff’s request 24

25 2 One of the two cases cited by Plaintiff—Jacobo II, 2022 U.S. Dist. LEXIS 10370, at *10, 2022 WL 2079766—does not concern a temporary restraining order and does not include the language 26 quoted in Plaintiff’s brief. In fact, in Jacobo II, the court ordered that cryptocurrency account holders were to be notified when subpoenas were issued to cryptocurrency exchanges holding 27 their accounts. Id., 2022 WL 2079766, at *4. However, that order followed an earlier order in the 1 that the third-party subpoena recipients be instructed not to notify account holders/users of the 2 subpoenas. This ruling does not preclude the subpoena recipients from seeking Plaintiff’s consent 3 or the Court’s permission to notify their account holders/users of the subpoenas, if appropriate. This ruling also does not excuse Plaintiff from making the necessary showing if he ultimately 4 seeks a temporary restraining order on an ex parte basis. 5 IV. CONCLUSION 6 For the reasons explained above, Plaintiff’s motion for leave to serve third-party subpoenas 7 prior to the Rule 26(f) conference is GRANTED IN PART as follows: 8 1. Plaintiff may promptly serve Rule 45 subpoenas on the VSAPs, Social 9 Media/Messaging Platforms, and ISPs identified in Plaintiff’s motion for leave that 10 are limited to seeking the following information about the holders of the accounts 11 identified in the motion: legal name, street address, telephone number, and email 12 address. The subpoenas to the VSAPs may also seek the account balances of the 13 accounts identified in the motion. The subpoenas may not seek any other 14 information including but not limited to Social Security numbers, Know Your 15 Customer or Anti-Money Laundering information, transaction information, 16 network and access logs, or device identifiers or registrations. Each subpoena must 17 attach a copy of this order. 18 2. The return date on each subpoena shall be NO LESS THAN 14 DAYS from the 19 date of service on the subpoena recipient. Each subpoena recipient shall have until the return date on the subpoena to object to the subpoena and/or file a 20 motion to modify or quash the subpoena, pursuant to Federal Rule of Civil 21 Procedure 45. 22 3. The subpoena recipient shall preserve any information responsive to the subpoena 23 pending the resolution of any timely-filed motion to quash, modify, or compel 24 compliance with the subpoena. 25 4. The subpoena recipient shall refrain from notifying any of the account holders 26 or users whose information has been subpoenaed until further order of the 27 Court. 1 subpoenas authorized by this order only in this litigation. Pending further order of 2 the Court, Plaintiff and his counsel shall maintain all information received in 3 response to the subpoenas as “Confidential” in accordance with the Court's model A protective order for standard litigation, available here: 5 https://cand.uscourts.gov/wp-content/uploads/forms/model-protective- 6 orders/CAND_StandardProtOrd.Feb2022.pdf 5 6. Plaintiff must seek leave of Court before serving subpoenas other than those authorized in this order prior to a Rule 26(f) conference. 8 SO ORDERED. 9 Dated: August 7, 2025 10

SUSAN VAN KEULEN United States Magistrate Judge

© 15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28