Legacy Investments Holdings, LLC v. John Does 1-20

• Court: District Court, N.D. California
• Decided: October 23, 2025
• Docket: 3:25-cv-08800
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA

LEGACY INVESTMENTS HOLDINGS, Case No. 25-cv-08800-RFL LLC,

Plaintiff, ORDER GRANTING MOTION FOR TEMPORARY RESTRAINING v. ORDER

JOHN DOES 1-20, Re: Dkt. No. 3 Defendant.

Plaintiff Legacy Investments Holdings, LLC (“Legacy”) applies ex parte for a temporary restraining order. (Dkt. No. 3 (“Motion”).) Legacy alleges that unknown Doe Defendants participated in a scheme to defraud its affiliate of cryptocurrency assets, and seeks an injunction to avoid dissipation of those assets. For the reasons explained in this order, the ex parte application is GRANTED. Legacy also seeks early discovery to ascertain Doe Defendants’ true identities, addresses, and other contact information, and for authorization to serve process by alternative means. Those additional requests are granted, for the reasons explained below. I. BACKGROUND Legacy alleges that on or about June 14, 2023, unknown Doe Defendants stole approximately $28 million in cryptocurrency assets from its affiliate, Legacy Worldwide Investments II, Ltd. (“Worldwide”), through a fraudulent airdrop that deployed a “malicious code” onto a trader’s computer, giving Doe Defendants access to Worldwide’s cryptocurrency wallet and allowing them to transfer the assets to their own account. (Dkt. No. 1 (“Compl.”) ¶¶ 2–3.) After discovering the theft, Legacy retained an expert, Julia Gottesman, to locate and trace the funds. Gottesman testified during a closed proceeding that she was able to track the assets to active lending contracts that Doe Defendants control. ee ee SS ee ee ee a ee ee a ee ee ee ee ee ee ee a a ee □□□ ee

□ ee

ee

————————————— rr

es

rr

—

ee a Il. TEMPORARY RESTRAINING ORDER The standard for issuing a temporary restraining order is identical to the standard for issuing a preliminary injunction. See Washington v. Trump, 847 F.3d 1151, 1159 n.3 (9th Cir. 2017) (“[T]he legal standards applicable to TROs and preliminary injunctions are substantially identical.” (internal quotation marks and citation omitted)). A plaintiff seeking preliminary injunctive relief must establish “[1] that he is likely to succeed on the merits, [2] that he is likely to suffer irreparable harm in the absence of preliminary relief, [3] that the balance of equities tips in his favor, and [4] that an injunction is in the public interest.” Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7, 20 (2008). “[I|f a plaintiff can only show that there are serious questions going to the merits—a lesser showing than likelihood of success on the merits—then a preliminary injunction may still issue if the balance of hardships tips sharply in the plaintiffs favor, and the other two Winter factors are satisfied.” Friends of the Wild Swan v. Weber, 767 F.3d 936, 942 (9th Cir. 2014) (internal quotation marks and citations omitted). An injunction is a matter of equitable discretion and is “an extraordinary remedy that may only be awarded upon a clear showing that the plaintiff is entitled to such relief.” Winter, 555 U.S. at 22. In limited circumstances, a court may issue a temporary restraining order upon a showing “that immediate and irreparable injury, loss, or damage will result to the movant before the adverse party can be heard in opposition.” Fed. R. Civ. P. 65(b)(1)(A) (emphasis added). A Regardless, a “TRO should be restricted to . . . preserving the status quo and preventing irreparable harm just so long as 1s necessary to hold a [preliminary myunction] hearing and no

longer.” E. Bay Sanctuary Covenant v. Trump, 932 F.3d 742, 779 (9th Cir. 2018) (quotation omitted). 1. Legacy Has Shown a Likelihood of Success on The Merits of Its Conversion Claim Legacy is likely to succeed on the merits of its conversion claim.3 “Conversion occurs where the defendant wrongfully exercises dominion over the property of another.” Bank of New York v. Fremont General Corp., 523 F.3d 902, 914 (9th Cir. 2008) (citations omitted). Under California law, the elements of a conversion claim are: “(1) plaintiffs’ ownership or right to possession of the property at the time of the conversion; (2) defendants’ conversion by a wrongful act or disposition of plaintiffs’ property rights; and (3) damages.” Joe Hand Promotions, Inc. v. Roseville Lodge No. 1293, 161 F. Supp. 3d 910, 916 (E.D. Cal. 2016). “Because conversion is a strict liability claim, a defendant’s good faith, lack of knowledge, motive, or intent are not relevant in establishing a claim for conversion.” Id. (quotation omitted). Here, Legacy, who is authorized to act on behalf of Worldwide, alleges that Doe Defendants “took over $28 million in digital assets from [Worldwide] without authorization.” (Compl. ¶¶ 40–41; Dkt. No. 4-5 ¶¶ 2–3; Dkt. No. 16-4.) Legacy’s expert, Gottesman, testified that Doe Defendants continue to hold the digital assets, causing Legacy and Worldwide harm. (See also Dkt. No. 4-5 ¶ 5.) Finally, Gottesman testified in detail as to why the assets that she has identified can be traced directly back to the stolen assets. Therefore, Legacy has shown a likelihood of success on the merits of its conversion claim. 2. Legacy Has Shown a Likelihood of Irreparable Harm, and That the Balance of Equities and Public Interest Favor Granting the Injunction Regarding the likelihood of irreparable harm, Legacy has shown that, absent injunctive relief, there is a significant risk that the assets will dissipate. See Goldwater Bank, N.A. v. Elizarov, No. 22-55404, 2023 WL 387037, at *2 (9th Cir. Jan. 25, 2023) (affirming the district

3 Because the Court finds that Legacy has shown a likelihood of success on its conversion claim, and will grant the ex parte motion for temporary injunctive relief on that basis, this order does not address Legacy’s likelihood of success on the merits of its other claims. court’s grant of preliminary injunction where the record indicated defendant likely intended to transfer or alienate plaintiffs’ assets). As Gottesman testified, the assets have been frequently transferred in complex anonymous transactions that appear intended to render them untraceable. Additionally, as Legacy notes, the “leveraged borrowing loop [in which the assets are currently tied up] coupled with the inherent volatility of the crypto market” could result in “a forced liquidation, irreversibly dissipating the stolen assets” if market prices fall. (Dkt. No. 3 at 19.)4 These risks justify entering a temporary restraining order. See Jacobo v. Doe, No. 22-cv-00672, 2022 WL 2052637, at *5 (E.D. Cal. June 7, 2022) (collecting cases finding that “the risk of irreparable harm [was] likely in matters concerning fraudulent transfers of cryptocurrency due to the risk of anonymous and speedy asset dissipation”). Furthermore, on the existing record, it appears that a limited-scope, short-term asset freeze is unlikely to present a great harm to Doe Defendants, and the balance of equities therefore tips in Legacy’s favor. However, the Court can lift this order if the Doe Defendants appear and show a continuing freeze would cause them prejudice. Finally, a temporary asset freeze will serve the public’s interest in stopping, investigating, and remedying frauds. 3. A Limited Scope Asset Freeze Without Prior Notice is Appropriate Where a plaintiff makes an ex parte request to freeze assets, the Court must also ensure it has authority to do so. “Typically, a court may issue an order to freeze the assets of a defendant only after the claims have been brought to judgment.” Jacobo, 2022 WL 2052637, at *3 (citing Grupo Mexicano de Desarrollo S.A. v. Alliance Bond Fund, Inc., 527 U.S. 308, 322 (1999)). A court may freeze assets earlier in the case when a plaintiff seeks equitable relief and a temporary restraining order is appropriate. See In re Focus Media Inc., 387 F.3d 1077, 1085 (9th Cir. 2004) (“Grupo Mexicano [] exempts from its proscription against preliminary injunctions freezing assets cases involving bankruptcy and fraudulent conveyances, and cases in which equitable relief is sought.”).

4 All citations to page numbers refer to ECF pagination. Because Legacy seeks equitable relief, including by constructive trust, this court may issue a temporary restraining order freezing the assets in question. (Compl. at 11 (Prayer for Relief)); Jacobo, 2022 WL 2052637, at *3. “A plaintiff seeking imposition of a constructive trust must show: (1) the existence of a res (property or some interest in property); (2) the right to that res; and (3) the wrongful acquisition or detention of the res by another party who is not entitled to it.” Mattel, Inc. v. MGA Entm’t, Inc., 616 F.3d 904, 908–09 (9th Cir. 2010) (applying California law). At this early stage, the record evidence submitted indicate that Legacy is likely to be able to support its request for a constructive trust, for the same reasons that it is likely to succeed on the merits of its conversion claim. Therefore, there is authority to order a temporary asset freeze. Furthermore, it is appropriate for the order to issue without notice to Doe Defendants. See Fed. R. Civ. P. 65(b)(1). The record contains specific facts showing that immediate dissipation of assets is likely if Doe Defendants were to receive advance notice, and Legacy’s counsel has certified in writing the reasons why notice should not be required. (Dkt. No. 3 at 21.) 4. No Bond is Required “The court may issue . . . a temporary restraining order only if the movant gives security in an amount that the court considers proper to pay the costs and damages sustained by any party found to have been wrongfully enjoined or restrained.” Fed. R. Civ. P. 65(c). Because Doe Defendants’ identity is unknown at this time, there is no evidence before the court demonstrating that defendant will suffer any damages as a result of the requested temporary restraining order. Therefore, the court will not require plaintiff to post a bond at this time. See Conn. Gen. Life Ins. Co. v. New Images of Beverly Hills, 321 F.3d 878, 882 (9th Cir. 2003) (“The district court is afforded wide discretion in setting the amount of the bond, and the bond amount may be zero if there is no evidence the party will suffer damages from the injunction.” (quotation omitted)). III. EARLY DISCOVERY Ordinarily, Federal Rule of Civil Procedure 26 does not permit discovery “from any source before the parties have conferred as required by Rule 26(f).” Fed. R. Civ. P. 26(d)(1). Pre-conference, courts normally require the party requesting early discovery to show “good cause.” See, e.g., Semitool, Inc. v. Tokyo Electron Am., Inc., 208 F.R.D. 273, 276 (N.D. Cal. 2002). Courts consider several factors, including the breadth and purpose of the plaintiff’s request, how burdensome it will be to comply, how far in advance of the ordinary timeline the request is made, and whether a preliminary injunction is in force. See Rovio Ent. Ltd. v. Royal Plush Toys, Inc., 907 F. Supp. 2d 1086, 1099 (N.D. Cal. 2012). One reason courts permit early discovery is to “ascertain the identity of a [d]oe defendant.” Jacobo v. Doe, No. 22-cv-00672, 2022 WL 2079766, at *2 (E.D. Cal. June 9, 2022) (collecting authority). Courts consider whether the plaintiff has described the doe defendant specifically enough to show that defendant is a “real person who can be sued in federal court”; what steps the plaintiff has already taken to understand who the doe defendant is; whether the complaint is likely to withstand a motion to dismiss; and whether discovery will reveal information that will permit the plaintiff to serve process. Digital Sin, Inc. v. Does 1-5698, No. 11-cv-04397-LB, 2011 WL 5362068, at *2 (N.D. Cal. Nov. 4, 2011). Here, Legacy has shown that good cause exists to permit early discovery to identify the Doe Defendants, as well as to locate the other assets beyond those that are the subject of the temporary restraining order (which originated only from Wallets One and Two). First, the record reflects that assets were taken from Legacy’s affiliate by unidentified individuals, and that despite a multi-year investigation Legacy has not been able to uncover the identities of the individuals who allegedly committed the theft or to trace all the assets taken. Second, the Court has already found that Legacy is likely to succeed on the merits on its conversion claim, and that it is entitled to a temporary restraining order. Finally, Legacy has proposed a targeted discovery plan that is likely to reveal relevant information about Doe Defendants’ identities and the assets allegedly stolen: it proposes serving subpoenas on various cryptocurrency platforms, which it believes to have information about the identities of Doe Defendants who used the platforms and the assets at issue. Therefore, Legacy is granted leave to serve subpoenas on third-party cryptocurrency exchanges and blockchain service providers used by Doe Defendants to hold or transfer the assets at issue. Discovery is authorized solely for the purpose of identifying the individuals or entities responsible for the alleged theft of assets in this case and for tracing the assets at issue. Each proposed subpoena recipient shall have 30 days from service of the subpoena to object to, or move to quash or modify, the subpoena, and this order is without prejudice to any objections recipients may wish to bring. IV. ALTERNATE SERVICE OF PROCESS “T]he method of service crafted by the district court must be ‘reasonably calculated, under all the circumstances, to apprise interested parties of the pendency of the action and afford them an opportunity to present their objections.’” Rio Props., Inc. v. Rio Int’l Interlink, 284 F.3d 1007, 1016 (9th Cir. 2002) (quoting Mullane v. Centr. Hanover Bank & Trust Co., 339 U.S. 306, 314 (1950)). Legacy seeks to serve via NFT, because it does not know the names, identities, or addresses of the Doe Defendants but does know the addresses of their cryptocurrency wallets,” which can receive NFTs. Legacy does not know if Doe Defendants are located in this district, or even in the United States, and therefore, it is not clear which service-related rules control. However, “the answer is immaterial for purposes of this motion.” Nibi, Inc., v. Doe, No. 24-cv-6184-EKL, Dkt. No. 22 at 4 (January 2, 2025). If any defendant is located in the United States, this Court may authorize a summons “in a manner which is reasonably calculated to give actual notice to the party to be served.” Cal. Civ. P. Code § 413.30; see also Fed. R. Civ. P. 4(e)(1) (permitting service “following state law . . . where the district court is located”). If any defendant is located outside of the United States, Federal Rule of Civil Procedure 4(f)(3) permits service by “means not prohibited by international agreement” and consistent with Constitutional due process, which requires service to be “reasonably calculated” to provide notice. Rio Props., Inc., 284 F.3d at

1015-16. Although the Hague Service Convention does impose restrictions on certain forms of service of documents abroad, those restrictions do not apply where the identity and address of the person to be served is not known. See Amazon.com Inc. v. Ananchenko, No. 23-cv-1703, 2024 WL 492283, at *2-4 (W.D. Wash. Feb. 7, 2024) (“The Hague Convention expressly “shall not apply where the address of the person to be served with the document is not known.”’) (quoting Hague Convention, art. 1.). Therefore, regardless of Doe Defendants’ locations, the same test applies: whether the proposed method of service is reasonably calculated to provide notice. The proposal satisfies that requirement. Legacy’s expert has testified that the wallets upon which service is proposed to be made have been recently active within the last several weeks, and that the activity is directly traceable to Doe Defendants. Furthermore, many courts have held that the proposed NFT service provides adequate notice in similar circumstances. See Nibi, Inc., No. 24- cv-6184-EKL, Dkt. No. 22 at 5 (collecting cases). Therefore, Plaintiffs are authorized to effectuate service via NFT on the following wallets, which Legacy’s expert testified have recently shown activity traceable to Doe Defendants as detailed above:

The NFT shall display on its face an image that includes the summons in this action when delivered to the addresses identified above. The NFT shall contain a notice of this action with summons language and a hyperlink to a website that hosts a copy of this Order, the concurrently filed Temporary Restraining Order, the Complaint, and the Motion, including copies of all related filing and exhibits. Plaintiff shall include messaging with the NFT indicating that it is effectuating service of official court documents, in order to mitigate the risk that Doe Defendants perceive the NFT as a scam or malicious code. Service via NFT shall be deemed effective upon successful transfer of the NFT to the identified wallet addresses. However, this order is without prejudice to

Doe Defendants later challenging service on the basis that they did not receive adequate notice of the lawsuit. V. CONCLUSION For the forgoing reasons, the Motion is GRANTED. A separate Temporary Restraining Order will issue. Dated: October 23, 2025 at 9:45 a.m. RITA F. LIN United States District Judge