Samuel Patrick Wolanyk v. John Does 1-15, individually and as an enterprise

• Court: District Court, D. Oregon
• Decided: January 23, 2026
• Docket: 3:26-cv-00127
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF OREGON

SAMUEL PATRICK WOLANYK, Case No.: 3:26-cv-00127-AN

Plaintiff, v. OPINION AND ORDER JOHN DOES 1-15, individually and as an enterprise,

Defendants. Plaintiff Samuel Patrick Wolanyk brings this action against defendants John Does 1-15, alleging claims for violations of the Racketeer Influenced and Corrupt Organizations Act ("RICO"), 18 U.S.C. § 1961 et seq., and Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030, as well as for fraud, conversion, and unjust enrichment under Oregon common law. On January 21, 2026, plaintiff filed the verified complaint, a motion to seal, a motion for expedited discovery, and a motion for temporary restraining order ("TRO") and preliminary injunction and declaration in support thereof. After reviewing plaintiff's filings, the Court finds that oral argument will not help resolve this matter. Local R. 7-1(d). For the reasons stated herein, the Court grants plaintiff's motion to seal; grants in part and denies in part plaintiff’s motion for expedited discovery; and grants in part and otherwise reserves ruling on plaintiff’s motion for TRO and preliminary injunction. LEGAL STANDARD A. TRO & Preliminary Injunction TROs and preliminary injunctions are subject to substantially the same legal standard. See Fed. R. Civ. P. 65; New Motor Vehicle Bd. of Cal. v. Orrin W. Fox Co., 434 U.S. 1345, 1347 n.2 (1977); Stuhlbarg Int'l Sales Co. v. John D. Brush & Co., 240 F.3d 832, 839 n.7 (9th Cir. 2001). A plaintiff seeking a TRO or preliminary injunction must show: (1) the plaintiff is likely to succeed on the merits; (2) the plaintiff is likely to suffer irreparable harm in the absence of preliminary relief; (3) the balance of equities tips in favor of the plaintiff; and (4) an injunction is in the public interest. Winter v. Nat. Res. Def. Council, Inc., 555 U.S. 7, 20 (2008). Ultimately, TROs and preliminary injunctions are "extraordinary remed[ies] that may only be awarded upon a clear showing that the plaintiff is entitled to such relief." Id. at 22. The Ninth Circuit uses a "serious questions" test which dictates that "'serious questions going to the merits' and a hardship balance that tips sharply toward the plaintiff can support issuance of [a TRO or] preliminary injunction, assuming the other two elements of the Winter test are also met." All. For the Wild Rockies v. Cottrell, 632 F.3d 1127, 1131-32 (9th Cir. 2011). Thus, under the serious questions test, a TRO or preliminary injunction can be granted if there is a likelihood of irreparable injury to the plaintiff, serious questions going to the merits, the balance of hardships tips sharply in favor of the plaintiff, and the injunction is in the public interest. M.R. Dreyfus, 697 F.3d 706, 725 (9th Cir. 2012). Under Federal Rule of Civil Procedure 65(a)(1), a preliminary injunction may only issue "on notice to the adverse party." In contrast, a plaintiff may seek a TRO ex parte—albeit only under very limited circumstances: a TRO may be issued without notice to the adverse party only if "specific facts in an affidavit or a verified complaint clearly show that immediate and irreparable injury, loss, or damage will result to the movant before the adverse party can be heard in opposition," and the movant's attorney "certifies in writing any efforts made to give notice and the reasons why it should not be required." Fed. R. Civ. P. 65(b)(1). Issuance of ex parte TROs is "extremely limited" because "'our entire jurisprudence runs counter to the notion of court action taken before reasonable notice and an opportunity to be heard has been granted both sides of a dispute.'" Reno Air Racing Ass'n v. McCord, 452 F.3d 1126, 1131 (9th Cir. 2006) (quoting Granny Goose Foods, Inc. v. Bhd. of Teamsters & Auto Truck Drivers Loc. No. 70 of Alameda Cnty., 415 U.S. 423, 438-39 (1974)). Courts have recognized that issuance of an ex parte TRO may be appropriate in limited circumstances "'where notice to the adverse party is impossible either because the identity of the adverse party is unknown or because a known party cannot be located in time for a hearing'" or "'because notice to the defendant would render fruitless the further prosecution of the action.'" Id. (quoting Am. Can Co. v. Mansukhani, 742 F.2d 314, 322 (7th Cir. 1984)). Ultimately, ex parte TROs "should be restricted to serving their underlying purpose of preserving the status quo and preventing irreparable harm just so long as is necessary to hold a hearing, and no longer." Granny Goose Foods, Inc., 415 U.S. at 439. A TRO "issued without notice must state the date and hour it was issued; describe the injury and state why it is irreparable; state why the order was issued without notice; and be promptly filed in the clerk's office and entered in the record." Fed. R. Civ. P. 65(b)(2). Then, "the motion for a preliminary injunction must be set for hearing at the earliest possible time." Fed. R. Civ. P. 65(b)(3). The adverse party, "[o]n [two] days' notice to the party who obtained the order without notice . . . may appear and move to dissolve or modify the order." Fed. R. Civ. P. 65(b)(4). A TRO issued without notice to the opposing party may not exceed fourteen days, except that it may be extended by the court one time, for no more than an additional fourteen days, upon showing of good cause. Fed. R. Civ. P. 65(b)(2). If the parties do not consent to an extension, then the court must schedule a preliminary injunction hearing to occur within twenty-eight days after the date of the issuance of the TRO. See id. B. Expedited Discovery Rule 26(d) allows for discovery prior to a Rule 26(f) conference under certain circumstances. Courts in the Ninth Circuit "use the 'good cause' standard to determine whether discovery should be allowed to proceed prior to a Rule 26(f) conference." Rovio Ent. Ltd. v. Royal Plush Toys, Inc., 907 F. Supp. 2d 1086, 1099 (N.D. Cal. 2012). "Good cause may be found where the need for expedited discovery, in consideration of the administration of justice, outweighs the prejudice to the responding party." Semitool, Inc. v. Tokyo Electron Am., Inc., 208 F.R.D. 273, 276 (N.D. Cal. 2002). In determining whether good cause exists, the court considers: "(1) whether a preliminary injunction is pending; (2) the breadth of the discovery requests; (3) the purpose for requesting the expedited discovery; (4) the burden on the defendants to comply with the requests; and (5) how far in advance of the typical discovery process the request was made." Am. LegalNet, Inc. v. Davis, 673 F. Supp. 2d 1063, 1067 (C.D. Cal. 2009) (quotation marks omitted). C. Sealing The public's "right of access to public records and proceedings is 'necessary to the enjoyment' of the right to free speech." Courthouse News Serv. v. Planet, 750 F.3d 776, 786 (9th Cir. 2014) (quoting Globe Newspaper Co. v. Superior Court for Norfolk County, 457 U.S. 596, 604 (1982)). Accordingly, "the courts of this country recognize a general right to inspect and copy public records and documents, including judicial records and documents." Nixon v. Warner Commc'ns, Inc., 435 U.S. 589, 597 (1978) (footnotes omitted). Courts in the Ninth Circuit "start with a strong presumption in favor of access to court records." Foltz v. State Farm Mut. Auto. Ins. Co., 331 F.3d 1122, 1135 (9th Cir. 2003). "A party seeking to seal a judicial record [] bears the burden of overcoming this strong presumption by meeting the 'compelling reasons' standard." Kamakana v. City & County of Honolulu, 447 F.3d 1172, 1178 (9th Cir. 2006) (quoting Foltz, 331 F.3d at 1135). To meet the compelling reasons standard, "the party must articulate compelling reasons supported by specific factual findings, that outweigh the general history of access and the public policies favoring disclosure, such as the public interest in understanding the judicial process." Id. at 1178-79 (citation modified). Thereafter, "the court must 'conscientiously balance[] the competing interests' of the public and the party who seeks to keep certain judicial records secret." Id. at 1179 (alteration in original) (quoting Foltz, 331 F.3d at 1135). D. Self-Represented Litigants Pleadings filed by self-represented litigants "are held to a less stringent standard than those drafted by lawyers." Graves v. Nw. Priority Credit Union, No. 3:20-cv-00770-JR, 2020 WL 8085140, at *2 (D. Or. Dec. 16, 2020) (citing Haines v. Kerner, 404 U.S. 519, 520 (1972)). "In cases involving a [self- represented] plaintiff, the court construes the pleadings liberally and affords the plaintiff the benefit of any doubt." Kali v. Bulk Handling Sys., No. 6:18-cv-02010-AA, 2019 WL 1810966, at *4 (D. Or. Apr. 23, 2019) (citing Wolfe v. Strankman, 392 F.3d 358, 362 (9th Cir. 2004)). BACKGROUND A. Factual Background Plaintiff alleges the following facts. On December 26, 2025, plaintiff's cryptocurrency was stolen through a sophisticated, coordinated cyberattack. Compl., ECF [1], ¶¶ 1-2, 12. The attack began when defendants reached out to plaintiff from a Mountain View, California phone number, pretending to be technical support staff for Gmail. Id. ¶ 13. Defendants told plaintiff that his account was "under attack" and guided him through a series of actions supposedly designed to restore security. Id. ¶ 14. In actuality, defendants spent the following three hours orchestrating the very attack they claimed to be thwarting. Id. ¶ 15. Over the course of the attack, defendants demonstrated knowledge of plaintiff's personal information, including his full name, phone number, email address, social security number, physical address, and cryptocurrency holdings. Id. ¶ 16. Defendants directed plaintiff to a series of fraudulent websites, including "view-ledger.com" and "notice-kraken.com" which were all designed to mimic legitimate pages. Id. ¶ 18. Defendants also communicated with plaintiff through several different channels, impersonating workers from Crypto.com, Coinbase, Kraken, and Ledger. Id. ¶ 17. Ultimately, defendants induced plaintiff to authorize the transfer of approximately 16.56579362 Bitcoin from his secure holdings to a single wallet controlled by defendants. Id. ¶¶ 19-21. On December 31, 2025, plaintiff initiated an investigation into the attack. Decl. of Samuel Patrick Wolanyk Supp. Mot. for TRO ("Pl. Decl."), ECF [6], Ex. A; Compl. ¶ 21. As of January 17, 2026, the trace has located several wallets holding plaintiff's Bitcoin, including an unhosted Bitcoin wallet found at address bc16707p48rt059hqakznucpsancpjvnxuqqz8yk4, and another wallet found at address bc1qns9f7yfx3ry9Ij6yz7c9er0vwa0ye2eklpzqfw, which plaintiff believes holds Bitcoin stolen from multiple victims. Id. ¶ 22. The investigation also revealed domain registration data for the fraudulent phishing sites and a machine ID and device ID believed to be associated with one of defendants. Id. ¶ 23. B. Procedural Background On January 21, 2026, plaintiff initiated this action. Plaintiff asserts six claims: three brought under federal question jurisdiction, for violations of (1) RICO, under 18 U.S.C. § 1962(c); (2) RICO, under 18 U.S.C. § 1962(d); and (3) CFAA; and three brought under supplemental jurisdiction, under Oregon common law, for (4) fraud, (5) conversion, and (6) unjust enrichment. See Compl. Plaintiff filed three motions alongside the complaint. Most pressingly, plaintiff filed a motion for TRO and preliminary injunction (the "TRO motion"), asking this Court to freeze the Bitcoin held in the two identified cryptocurrency wallet addresses and in "any successor or downstream wallets to which [the Bitcoin at issue] may be transferred," and to "[p]rohibit[] [d]efendants, and all persons acting in concert with them or on their behalf, from transferring, encumbering, dissipating, or otherwise disposing of Bitcoin or other cryptocurrency traceable to [p]laintiff's stolen [Bitcoin]." Mot. for TRO & Prelim. Inj. ("TRO Mot."), ECF [5], at 2. Plaintiff also filed a supporting declaration. Pl. Decl. Second, plaintiff filed a motion for expedited discovery, seeking "leave to immediately serve narrowly tailored subpoenas on" a variety of entities in order to "obtain basic information, IP logs, call records, and KYC/account data" needed to identify the doe defendants, preserve electronic evidence, and effectuate the TRO. Mot. for Expedited Disc., ECF [4], at 2-3. Finally, plaintiff moves the Court for permission "to redact from the public docket certain personal identifying information [] and sensitive security-related information"; to file redacted public copies and unredacted sealed copies of his complaint, motions, and declarations; to use a "P.O. Box . . . as his publicly listed mailing address in lieu of his residential address"; and for the Court to "[g]rant[] any further relief necessary to implement these protections." Mot. to Redact Personal Identifying Info. & File Certain Materials Under Seal ("Mot. to Seal"), ECF [3], at 2-3. Defendants have not been served or appeared in this case and have not been served any of the three motions pending before the Court. DISCUSSION The Court first considers plaintiff's TRO motion, followed by the motion for expedited discovery, and then the motion to seal. A. TRO 1. Preliminary Procedural Requirements Plaintiff argues that an ex parte TRO is appropriate in this case because (1) "[d]efendants are anonymous John Does with no known physical locations or direct contact information," and (2) "[i]f [defendants] receive advance notice of [plaintiff's] motion before a freeze is in place, they can immediately transfer or further obfuscate the Bitcoin, defeating the purpose of the requested relief." TRO Mot. 7. Plaintiff reasons that "[c]ryptocurrency transfers are instantaneous and irreversible," and "[e]ven a short delay could enable [d]efendants to place the funds beyond this Court's effective reach." Id. Plaintiff's signed declaration lends further support to his arguments. Plaintiff declares that "[e]x parte relief is necessary because providing notice to [d]efendants would be futile and dangerous." Pl. Decl. ¶ 74. Notice would be futile because defendants "are anonymous individuals and entities operating under pseudonyms" and, as such, plaintiff "do[es] not know their true identities, locations, or contact information," and "[t]here is no practical way to provide notice to anonymous defendants who are actively concealing their identities." Id. ¶¶ 75-77. Plaintiff further declares that if defendants receive notice before a TRO is issued, "they will immediately transfer the Bitcoin to prevent its seizure," which is an "instantaneous and irreversible" process that can be accomplished with only "a few hours' notice." Id. ¶¶ 78-79. Where "[d]efendants have already demonstrated their sophistication in obfuscating blockchain transactions," providing them with "[n]otice would simply trigger further obfuscation." Id. ¶ 80. Finally, plaintiff raises concerns as to his and his family's personal safety, noting that defendants "possess significant personal information about" him and "have demonstrated they are part of a sophisticated criminal organization willing to engage in illegal activity for financial gain." Id. ¶¶ 81-83. Against this backdrop, and in light of both the high dollar value of the Bitcoin at issue in this case and reported incidents of victims of cryptocurrency theft facing violence, threats, and physical harm, plaintiff fears that providing defendants notice before a TRO is issued will expose plaintiff and his family to retaliation, threats or intimidation, physical harm, and additional criminal targeting. Id. ¶¶ 84-86. Plaintiff has satisfied the preliminary requirements for issuing a TRO without notice. Plaintiff's signed declaration "certif[ies] in writing . . . why [notice] should not be required," Fed. R. Civ. P. 65(b)(1)(B),1 namely, because (1) defendants' identities are unknown and may only be determined

1 The plain language of Rule 65 states that "the movant's attorney" must make this written certification, Fed. R. Civ. P. 65(b)(1)(B), and there can be no doubt that the procedural requirements of Rule 65 are meant to be closely adhered to, see, e.g., Abdel-Malak v. Doe, No. EDCV 20-00322-CJC(KKx), 2020 WL 5775818, at *1 (C.D. Cal. Feb. 20, 2020) (finding the plaintiff's "failure to comply with Rule 65(b)'s strict requirements [was] fatal to his application for a temporary restraining order."). A strict reading of Rule 65 may thus suggest that a court may never issue an ex parte TRO when a plaintiff is self-represented. However, in accord with case law interpreting Rule 65, the Court considers plaintiff's declaration to be sufficient to satisfy Rule 65(b)(1)(B)'s written certification requirement. See, e.g., Sibomana v. Larose, No. 22CV933-LL-NLS, 2022 WL 2918911, at *1 (S.D. Cal. July 25, 2022) ("The Court may issue a TRO without written or oral notice to the adverse party (ex parte) or the adverse party's attorney only if: . . . through expedited discovery; and (2) defendants are likely to move plaintiff's assets beyond this Court's reach. As to plaintiff's first point, an ex parte TRO may be appropriate is when "notice to the adverse party is impossible . . . because the identity of the adverse party is unknown[.]" Reno Air Racing, 452 F.3d at 1131 (citation and quotation marks omitted). As to plaintiff's second point, courts have recognized that an action involving cryptocurrency "poses a heightened risk of asset dissipation" and, for this reason, if the defendants in such an action are provided notice, "it would be a simple matter for [those defendants] to transfer [the assets at issue] to unidentified recipients outside the traditional banking system, including contacts in foreign countries, and effectively put it beyond the reach of th[e] [c]ourt." Fed. Trade Comm'n v. Dluca, No. 0:18-cv-60379-RKA, 2018 WL 1830800, at *2 (S.D. Fla. Feb. 28, 2018), report and recommendation adopted, No. 0:18-cv-603-79-KMM, 2018 WL 1811904 (S.D. Fla. Mar. 12, 2018); see Jacobo v. Doe, 1:22-cv-00672-DAD-BAK (BAM), 2022 WL 2052637, at *5 (E.D. Cal. June 7, 2022) ("Jacobo I") (noting "the risk of anonymous and speedy asset dissipation" in cryptocurrency actions). Those same risks apply with equal force here. This is sufficient to "clearly show that immediate and irreparable injury, loss, or damage will result to [him] before the adverse party can be heard in opposition." Fed. R. Civ. P. 65(b). 2. Winter Factors a. Likelihood of Success on the Merits Plaintiff has shown a likelihood of success on the merits of his conversion claim. "[U]nder Oregon common law, '[c]onversion is an intentional exercise of dominion or control over a chattel which so seriously interferes with the right of another to control it that the actor may justly be required to pay the other the full value of the chattel.'" Chambers v. Am. Fed'n of State, Cnty, & Mun. Emps. Int'l Union, AFL- CIO, 450 F. Supp. 3d 1108, 1114 (D. Or. 2020) (quoting Scott v. Jackson County, 244 Or. App. 484, 499, 260 P.3d 744 (2011)). A plaintiff asserting a conversion claim "must allege that they were entitled to 'immediate possession' of the 'chattel' at issue." Id. (quoting Willamette Quarries, Inc. v. Wodtli, 308 Or.

the applicant's attorney (or, as in this case, a plaintiff proceeding pro se) certifies any efforts made to give notice to the adverse party and reasons supporting the claim that notice should not be required."). 406, 413, 781 P.2d 1196 (1989)). "Money can qualify as a chattel for purposes of a conversion claim only 'when the money was wrongfully received by the party charged with conversion, or an agent is obligated to return specific money to the party claiming it.'" Id. at 1114-15 (quoting Waggoner v. Haralampus, 277 Or. 601, 604, 561 P.2d 586 (1977)). Here, plaintiff states that, despite his ownership and right to immediate possession of the Bitcoin at issue, "[d]efendants unlawfully and intentionally exercised dominion and control over [the] Bitcoin, by means of fraud and deceit, depriving [p]laintiff of his property." Compl. ¶¶ 53-54. Plaintiff adds that defendants' exercise of dominion and control over the Bitcoin "was without [p]laintiff's consent and was wrongful," and that as a result, "[p]laintiff suffered damages in the amount of approximately 16.56579362 [Bitcoin]." Id. ¶¶ 55-56. These statements in the verified complaint are sufficient to show that defendants wrongfully received and retained plaintiff's Bitcoin. Thus, plaintiff has shown a likelihood of success on the merits of his conversion claim. Based on this finding, the Court need not, and therefore does not, reach the question of whether plaintiff has shown a likelihood of success on the merits with regard to his remaining claims. See Jacobo I, 2022 WL 2052637, at *4 (declining to address remaining claims where the plaintiff showed likelihood of success on the merits of her conversion claim). b. Likelihood of Irreparable Harm Plaintiff has also shown a significant risk that the assets at issue will dissipate without a TRO. Plaintiff avers that the nature of cryptocurrency is such that it "can be transferred instantaneously and irreversibly across borders and through multiple wallets" and that defendants in this case "have already demonstrated their intent and capability to move and obfuscate the stolen Bitcoin through complex blockchain transactions." Pl. Decl. ¶¶ 46-47. Plaintiff asserts an ever-increasing risk that defendants will "[t]ransfer the Bitcoin to exchanges and convert it to fiat currency"; "[m]ove the Bitcoin through additional obfuscatory wallets, making tracing more difficult"; "[t]ransfer the Bitcoin to 'mixing' services or privacy coins, rendering recovery impossible"; "[d]istribute the Bitcoin among multiple co-conspirators"; or "[m]ove the Bitcoin offshore to jurisdictions beyond this Court's reach." Id. ¶ 48. Finally, plaintiff asserts that "[o]nce the Bitcoin is converted to fiat currency, withdrawn, or sufficiently obfuscated, recovery becomes practically impossible, even with a favorable judgment." Id. ¶ 49. Based on these allegations, the Court concludes that the risk of dissipation is sufficient to support a likelihood of irreparable harm absent immediate injunctive relief. See Legacy Invs. Holdings, LLC v. John Does 1-20, No. 25-cv-08800-RFL, 2025 WL 2988640, at *2 (N.D. Cal. Oct. 23, 2025) (citing Goldwater Bank, N.A. v. Elizarov, No. 22-55404, 2023 WL 387037, at *2 (9th Cir. Jan. 25, 2023)) (finding a likelihood of irreparable harm based on a significant risk of asset dissipation); Jacobo I, 2022 WL 2052637, at *5. Cf. Block Mining, Inc. v. Hosting Source, LLC, No. C24-0319-JLR, 2024 WL 1156479, at *5 (W.D. Wash. Mar. 18, 2024) (holding that a threat to property could not constitute irreparable harm where there is no threat of asset dissipation); JustM2J LLC v. Brewer, No. 2:25-cv-00380-DAD-SCR, 2025 WL 435827, at *9 (E.D. Cal. Feb. 7, 2025) (finding an insufficient risk of asset dissipation where the identities of the defendants were known). c. Balance of Equities Based on the record before the Court, it appears unlikely that plaintiff's requested relief— i.e., a narrowly tailored asset freeze—would present any significant harm to defendants. See Legacy Invs. Holdings, 2025 WL 2988640, at *2; Jacobo I, 2022 WL 2052637, at *5-6. Furthermore, any potential harm could be quickly remedied by the Court's lift of the TRO, should defendants appear and show prejudice. See Legacy Investment Holdings, 2025 WL 2988640, at *2. Balanced against the significant harm that plaintiff faces if the assets at issue are placed beyond the Court's reach, the Court finds that the balance of equities tips in plaintiff's favor. d. Public Interest Finally, the public interest factor also weighs in favor of issuing a TRO, as a temporary asset freeze in such circumstances "serve[s] the public's interest in stopping, investigating, and remedying frauds." Id. at *2; see TRO Mot. 6-7. 3. Scope of TRO Having found that issuance of a TRO is appropriate, the Court must now consider the appropriate scope of relief to be granted. As relevant here, "[w]here a plaintiff makes an ex parte request to freeze assets, the Court must also ensure it has authority to do so." Legacy Invs. Holdings, 2025 WL 2988640, at *2. Although courts are typically restricted from freezing a defendant's assets until "after the claims have been brought to judgment," Jacobo I, 2022 WL 2052637, at *3 (citing Grupo Mexicano de Desarrollo S.A. v. Alliance Bond Fund, Inc., 527 U.S. 308, 322 (1999)), a court nonetheless "may freeze assets earlier in the case when a plaintiff seeks equitable relief and a temporary restraining order is appropriate," Legacy Invs. Holdings, 2025 WL 2988640, at *2 (citing In re Focus Media Inc., 387 F.3d 1077, 1085 (9th Cir. 2004)). Here, both requirements are met: (1) plaintiff seeks equitable relief, see Compl. ¶¶ 57-61 (asserting equitable claim for unjust enrichment); see also Pl. Decl. ¶ 51 (averring that "[m]oney damages are inadequate to remedy [plaintiff's] harm"); and (2) the Court has concluded above that a TRO is appropriate. Admittedly, there is some tension in plaintiff's filings as to the nature of the relief he requests. Case law indicates that requested equitable relief such as a constructive trust or restitution is a sufficient basis for a court to freeze assets prior to entry of judgment. See Legacy Invs. Holdings, 2025 WL 2988640, at *2 (constructive trust); Jacobo I, 2022 WL 2052637, at *3 (constructive trust and restitution). Here, plaintiff—who is self-represented—has not pleaded these terms. What plaintiff does seek is not entirely clear: in the complaint, he appears to effectively seek restitution, in the form of "compensatory damages in the amount of [the stolen Bitcoin], or its equivalent USD value at the time of judgment."2 Compl. 16. However, plaintiff also avers that "[m]oney damages are inadequate to remedy [his] harm[.]" Pl. Decl. ¶ 51. In this case, the Court concludes that plaintiff has adequately indicated that he seeks equitable relief. Under Oregon law, "[t]he concepts of constructive trust and unjust enrichment [] are intertwined," and although Oregon Supreme Court cases "refer to a substantive 'doctrine' of unjust enrichment, . . . the cases simply describe the kinds of actions and circumstances that would constitute unjust enrichment warranting imposition of a constructive trust." Tupper v. Roan, 349 Or. 211, 219-20, 243 P.3d 50 (2010) (en banc). Here, plaintiff has set forth a claim for unjust enrichment that is, by its very

2 To complicate the matter, a plaintiff may seek restitution as a legal remedy or an equitable one. See Great-W. Life & Annuity Ins. Co. v. Knudson, 534 U.S. 204, 212-13 (2002). nature under Oregon law, intertwined with the remedy of constructive trust. Plaintiff has also made clear that money damages are an insufficient remedy. And, importantly, plaintiff is self-represented and thus afforded certain leniency. Taken together, plaintiff has made an adequate showing that he seeks equitable relief such that the Court is within its authority to freeze defendants' assets at this time. 4. Bond Generally, a court may only issue a TRO "if the movant gives security in an amount that the court considers proper to pay the costs and damages sustained by any party found to have been wrongfully enjoined or restrained." Fed. R. Civ. P. 65(c). District courts are "afforded wide discretion in setting the amount of the bond, and the bond amount may be zero if there is no evidence the party will suffer damages from the injunction." Conn. Gen. Life Ins. Co. v. New Images of Beverly Hills, 321 F.3d 878, 882 (9th Cir. 2003) (internal citation omitted). Here, there is no evidence before the Court that suggests defendants, whose identities are unknown, will suffer any prejudice or damages as a result of the requested TRO. For this reason, the Court declines to require plaintiff to post a bond at this time. B. Expedited Discovery Plaintiff has shown good cause to allow expedited discovery under Rule 26. One permissible reason for expedited discovery is to "ascertain the identity of a [d]oe defendant." Jacobo v. Doe, No. 22-cv-00672, 2022 WL 2079766, at *2 (E.D. Cal. June 9, 2022) ("Jacobo II") (collecting cases). Under such circumstances, courts may consider alongside the traditional analysis (1) "whether the plaintiff has described the doe defendant specifically enough to show that [the] defendant is a 'real person who can be sued in federal court'"; (2) "what steps the plaintiff has already taken to understand who the doe defendant is"; (3) "whether the complaint is likely to withstand a motion to dismiss"; and (4) "whether discovery will reveal information that will permit the plaintiff to serve process." Legacy Invs. Holdings, 2025 WL 2988640, at *3 (quoting Jacobo II, 2022 WL 2079766, at *2). First, the factors relating to good cause generally support granting expedited discovery in this case. See Am. LegalNet, Inc., 673 F. Supp. 2d at 1067 (listing relevant factors). The Court has already found that issuance of a TRO is appropriate; plaintiff has generally tailored the breadth of his discovery requests to reflect their general purpose, which is to ascertain defendants' identities; there is no burden on defendants to comply with the requests, as they are directed to third parties; and the request for expedited discovery has been made early in the litigation. Moreover, "[a]s a practical matter, this case cannot proceed to a Rule 26(f) conference until the [d]efendants are identified, added to the case, served, and appear." Kippes v. Does 1-25, No. 25-cv-03616-SVK, 2025 WL 2607669, at *4 (N.D. Cal. Aug. 7, 2025); see Legacy Invs. Holdings, 2025 WL 2988640, at *3; see also Jacobo II, 2022 WL 2079766, at *3-4. Second, several of the factors related to ascertaining the identities of doe defendants also favor expedited discovery here. See Jacobo II, 2022 WL 2079766, at *2. Plaintiff has described the use of blockchain analytics to trace the path of the Bitcoin at issue and has identified two cryptocurrency wallet addresses to which his assets have been transferred without his consent. Pl. Decl. 8-10. In finding that plaintiff has shown a likelihood of success on the merits of his conversion claim, the Court has concluded that plaintiff has "demonstrated that the action" is likely to "withstand a motion to dismiss." ZG TOP Tech. Co. v. Doe, No. C19-92-RAJ, 2019 WL 917418, at *2 (W.D. Wash. Feb. 25, 2019). However, plaintiff's suggested discovery requests are not sufficiently tailored toward their stated purpose, i.e., to glean defendants' identities. See Jacobo II, 2022 WL 2079766, at *4. Plaintiff seeks to obtain "basic identifying information, IP logs, call records, and KYC/account data" from a variety of entities, including Google LLC; T-Mobile USA, Inc.; Mandrill/Mandrillapp; domain registrars; cryptocurrency exchange and money service businesses; and several voice and telecommunications providers. See Pl. Mot. for Expedited Disc. 2-3. In particular, plaintiff's request for call records and certain account data appears to seek documents or communications beyond specific identifying information about defendants. See Jacobo II, 2022 WL 2079766, at *4 (denying request for expedited discovery "beyond certain specific identify information about the [d]oe defendant"). Accordingly, and as described in greater detail below, the Court grants plaintiff's request for expedited discovery for the limited purpose of ascertaining defendants' identities but denies plaintiff's request for expedited discovery to the extent it seeks documents or communications beyond that limited purpose. C. Sealing Plaintiff asks the Court for permission to redact certain personal identifying information and to file certain documents under seal. The Court finds that, based on the contents of plaintiff's signed declaration and other filings, there are compelling reasons to redact plaintiff's personal identifying information and to file documents under seal, so long as those sealed documents are accompanied by appropriately redacted, unsealed copies. On balance, these compelling reasons—namely, protection of plaintiff and his family's safety—outweigh the public policies favoring disclosure. CONCLUSION A. Motion for TRO & Preliminary Injunction For the reasons stated herein, plaintiff's Motion for Temporary Restraining Order and Preliminary Injunction, ECF [5], is GRANTED IN PART, as follows: 1. Pending a hearing on a motion for preliminary injunction, defendants and any persons or entities acting in concert with defendants shall be restrained and enjoined from withdrawing, transferring, encumbering, dissipating, or otherwise disposing of Bitcoin or other cryptocurrency traceable to the Bitcoin at issue in this case. This includes cryptocurrency assets in the two cryptocurrency wallet addresses identified by plaintiff, i.e., bc1q6707p48rt059hqakznucpsancpjvnxuqqz8yk4 and bc1qns9f7yfx3ry9Ij6yz7c9er0vwa0ye2eklpzqfw. Defendants are further ordered to preserve all Bitcoin or other cryptocurrency traceable to the Bitcoin at issue in this case, including cryptocurrency assets in the two cryptocurrency wallet addresses identified by plaintiff, i.e., bc1q6707p48rt059hqakznucpsancpjvnxuqqz8yk4 and bc1qns9f7yfx3ry9Ij6yz7c9er0vwa0ye2eklpzqfw 2. Plaintiff shall not be required to post bond pursuant to Federal Rule of Civil Procedure 65(c). 3. Plaintiff shall provide notice of this order to all third-party platforms and exchanges that hold or control Bitcoin at issue, pursuant to Rule 65(d)(2). 4. Notice was not provided to defendants prior to entry of this order because their identities are presently unknown to plaintiff and because the risk of asset dissipation is such that immediate and irreparable injury, loss, or damage will result to plaintiff before the adverse party can be heard in opposition. 5. This TRO will expire fourteen (14) days from the date of its entry in accordance with Rule 65(b)(2) unless, for good cause shown, this TRO is extended (or defendants consent that it should be extended) for a longer period of time. That means this temporary restraining order shall remain in effect until February 6, 2026, at 5:00 p.m. Pacific Time. 6. Defendants are notified of their right to apply to the Court for modification or dissolution of this TRO, if appropriate and supported by a showing of good cause, on two (2) days' notice, or such shorter notice as the Court may allow. See Fed. R. Civ. P. 65(b)(4). 7. Defendants are advised that their failure to timely serve and file an opposition, or to appear at a hearing on a motion for preliminary injunction, may result in the imposition of a preliminary injunction against them pursuant to Rule 65. The Court otherwise RESERVES RULING on this motion. The Court will promptly schedule a hearing as to plaintiff's request for a preliminary injunction. B. Motion for Expedited Discovery Plaintiff's Motion for Expedited Discovery, ECF [4], is GRANTED IN PART, as follows: 1. As specified further below, plaintiff may immediately serve subpoenas under Federal Rule of Civil Procedure 45, seeking defendants' basic identifying information, including defendants' legal names, street addresses, telephone numbers, and e-mail addresses. Any such subpoena (1) should be served with a copy of this order, and (2) may not seek documents or communications other than basic identifying information for defendants, as described in this order. 2. Specifically, plaintiff is permitted to serve Rule 45 subpoenas on the following entities: (1) Google LLC; (2) T-Mobile USA, Inc.; (3) Mandrill/Mandrillapp; (4) the domain registrars and/or hosting providers responsible for (a) review-ledger.com, and (b) notice-kraken.com; (5) any cryptocurrency exchange(s) or money service business(es) identified in the Manus AI blockchain tracing report identified in plaintiff's filings as having received or currently holding plaintiff's Bitcoin; and (6) the voice and telecommunications providers identified through reverse phone analysis as providing or carrying the phone numbers involved in the cyberattack on plaintiff, including (a) Iristel Inc., (b) Qwest Corporation, (c) Bandwidth.com, (d) Yahoo and Hotmail, and (e) Global Crossing. 3. If a cryptocurrency exchange or money service business is served with a subpoena authorized by this order, that cryptocurrency exchange or money service business shall serve a copy of the subpoena and a copy of this order to defendants and any other affected user as soon as possible after service of the subpoena is made on the cryptocurrency exchange or money service business. The cryptocurrency exchange or money service business may serve the user using any reasonable means, including written notice sent to the user's last known address, transmitted either by first-class mail or via overnight service. The cryptocurrency exchange or money service business shall provide plaintiff with the date when such notice was provided to any affected user. 4. The cryptocurrency exchange or money service business and any affected user shall have seven (7) days from the respective date of service of the subpoena upon them to object to the subpoena pursuant to Rule 45(d)(2)(B). 5. The cryptocurrency exchange or money service business shall not disclose any defendant's identifying information, or such information for any other affected user, during the seven-day period or if a timely objection is served unless and until the Court orders it to do so. 6. If an objection is served, the cryptocurrency exchange or money service business shall preserve any material responsive to the subpoena for a period of no less than ninety (90) days in order to allow plaintiff to move for an order compelling production under Rule 45(d)(2)(B)(i). 7. If no objection is served, the cryptocurrency exchange or money service business shall comply with the subpoena within seven (7) days unless an objection to the subpoena will be filed within seven (7) days of the subpoena's service. 8. Within two (2) days of learning any defendant's true legal identity and obtaining any defendant's contact information, plaintiff shall serve copies of the complaint, TRO motion, and this order on the identified defendant(s) and to the identified contact information in accordance with Federal Rule of Civil Procedure 4. In all other respects, plaintiff's motion for expedited discovery is DENIED. C. Motion to Seal Plaintiff's Motion to Redact Personal Identifying Information and to File Certain Materials Under Seal, ECF [3], is GRANTED as follows: 1. The following personal identifying information shall be redacted from the docket: plaintiff's residential street address and any description that would reasonably identify plaintiff's home; plaintiff's personal cell phone number and personal email address, beyond that needed for service and contact with this Court; and specific device identifiers for plaintiff's devices, including IP addresses and security configuration details associated with plaintiff's home, accounts, and hardware wallet. 2. Plaintiff may file redacted public versions of the complaint, motion to seal, motion for expedited discovery, TRO motion, and his declaration. Plaintiff shall file unredacted versions under seal. 3. Plaintiff is permitted to use as his public listed mailing address the P.O. Box located at 2000 NE 42nd Ave PMB 1075, Portland, OR 97213. Plaintiff shall not be required to use his residential address as his public listed mailing address. D. Status Report Finally, plaintiff is ORDERED to provide a status report to the Court identifying the steps he has taken to identify and serve defendants within seven (7) days of the date of this order.

IT IS SO ORDERED.

DATED this 23rd day of January, 2026, at 5:19 p.m.

Adrienne Nelson United States District Judge