BELLIS v. KELLY, 797 F.Supp.3d 431

MEMORANDUM ORDER

O‘HEARN, District Judge.

THIS MATTER comes before the Court by way of a Motion for Expedited Discovery, filed ex parte, by John Bellis (“Plaintiff“). (ECF No. 5). This Court has jurisdiction under 28 U.S.C. § 1331 because this case involves a federal question under the Computer Fraud and Abuse Act (“CFFA“), 18 U.S.C. § 1030 et seq. Plaintiff seeks leave to serve narrowly tailored, time-sensitive discovery on A.R., a minor, by and through his parent and natural guardian Dulaney Kelly; Dulaney Kelly individually; and unknown persons (collectively, “Individual Defendants“), as well as on Payword, Inc. (d/b/a Kraken); XT.com; HTX.com; Cobo.com; Coinbase, Inc.; and certain unknown entities (collectively, “Relief Defendants“), in order to identify the parties responsible for stealing Plaintiff‘s cryptocurrency, trace the location of stolen assets, and preserve critical evidence. Pursuant to Local Rule 78.1, the Court did not hear oral argument. For the reasons that follow, Plaintiff‘s Motion is GRANTED.

I. BACKGROUND

Plaintiff is a hedge fund trader who resides in Montgomery County, Pennsylvania, and owns a family home in Avalon, New Jersey. (Bellis Decl., ECF No. 2-2 at ¶ 1). On July 28, 2025, Plaintiff alleges that his stepson, A.R., with the aid of his biological father, Dulaney Kelly, accessed Plaintiff‘s personal devices and stole $430,000 worth of cryptocurrency—specifically, 3.506 Bitcoins and 65.027 Solana Coins (the “Stolen Assets“)—from Plaintiff‘s Gemini account. (Compl., ECF No. 1 at ¶¶ 1, 6, 8; Bellis Decl., ECF No. 2-2 at ¶ 4).

A.R. allegedly used confidential information, including Plaintiff‘s iPhone PIN and digital asset credentials (“Confidential Information“), which he obtained by surreptitiously accessing a document on Plaintiff‘s desktop labeled “JABIII – If I Die” during a June 2025 visit to the Avalon home. (Compl., ECF No. 1 at ¶¶ 49–51; Bellis Decl., ECF No. 2-2 at ¶¶ 9–10). With this information, A.R. disabled Gemini‘s “Wallet Whitelisting” security feature, thereby removing the mandatory seven-day hold on adding new crypto wallets. (Compl., ECF No. 1 at ¶¶ 52–53; Bellis Decl., ECF No. 2-2 at ¶ 12). According to Plaintiff‘s forensic experts, these actions were executed locally from Plaintiff‘s own devices. (Bellis Decl., ECF No. 2-2 at ¶ 17; Ex. A, ECF No. 2-2 at 10–11; Ex. C, ECF No. 2-2 at 43).

In late July 2025, A.R. returned to Avalon for a family visit. (Compl., ECF No. 1 at ¶¶ 56–57; Bellis Decl., ECF No. 2-2 at ¶ 13). During the early morning hours of July 28, A.R. allegedly used the stolen PIN to access Plaintiff‘s iPhone, added his own cryptocurrency wallets to the Gemini account, and transferred the Stolen Assets to himself. (Compl., ECF No. 1 at ¶ 60; Bellis Decl., ECF No. 2-2 at ¶ 14). A forensic investigation confirmed that at 4:53 a.m. that day, a fake “hacker note” was typed on Plaintiff‘s desktop computer, which A.R. allegedly used in an effort to obscure his involvement. (Compl., ECF No. 1 at ¶¶ 62, 78; Bellis Decl., ECF No. 2-2 at ¶¶ 15–16; Ex. C, ECF No. 2-2 at 43).

Blockchain analysis has since traced the stolen BTC and SOL across multiple wallets and cryptocurrency exchanges. (Ex. B, ECF No. 2-2 at 13–32; see also Compl., ECF No 1 at ¶¶ 67–76; Bellis Decl., ECF No. 2-2 at ¶¶ 5, 29–30, 35). Specifically, forensic investigators determined that A.R. employed common laundering tactics such as peel chaining, funnel wallets, and co-mingling, ultimately transferring Plaintiff‘s assets to at least five Virtual Asset Service Providers (“VASPs“), including Kraken, HTX, XT.com, Cobo.com, and Coinbase. (Compl., ECF No 1 at ¶¶ 74–76, 87–88; Ex. B, ECF No. 2-2 at 16–20). As of August 21, 2025, a total of 3.267 BTC and 62.647 SOL had been deposited with these exchanges. (Compl., ECF No 1 at ¶ 76; Ex. B, ECF No. 2-2 at 20).

Plaintiff alleges that Kelly not only failed to prevent A.R.‘s misconduct but also enabled and concealed it by allowing A.R. continued access to electronic devices despite a court order restricting his internet usage in a separate Ohio cybercrime prosecution. (Compl., ECF No. 1 at ¶¶ 13, 43–47, 80–82, 85–86, 89–90; Bellis Decl., ECF No. 2-2 at ¶¶ 6–8, 22–24, 27–28, 31-32).

On August 26, 2025, Plaintiff filed his Complaint, (ECF No. 1), and Motion for a Temporary Restraining Order. (ECF No. 2). Plaintiff asserts claims under the CFAA, 18 U.S.C. § 1030 et seq. (“Count I“); the New Jersey Computer-Related Offenses Act, N.J.S.A. § 2A:38A (“Count II“); Fraud (“Count III“); Conversion (“Count IV“); Replevin, N.J.S.A § 2B:50-1 (“Count V“); Unjust Enrichment (“Count VI“); Misappropriation of Confidential Information (“Count VII“); Civil Conspiracy (“Count VIII“); and Negligence (“Count IX“). (Compl., ECF No. 1 at ¶¶ 94-176). Plaintiff also seeks equitable relief (“Count X“), including an order imposing a constructive trust, enjoining Defendants from transferring or dissipating the Stolen Assets, requiring a sworn accounting of wallets and transactions involving the Stolen Assets, and directing A.R. to return and cease all use of Plaintiff‘s Confidential Information. (Compl., ECF No. 1 at ¶¶ 177-185; Proposed Order, ECF No. 2-3). The Court granted the Motion for a Temporary Restraining Order on August 28, 2025. (ECF No. 6).

II. LEGAL STANDARD

Federal Rule of Civil Procedure 26(d)(1) provides that, as a general matter, discovery may not begin until the parties have conferred under Rule 26(f). But that timing rule is not inflexible. District courts retain broad discretion to manage their own dockets and the course of discovery. See In re Fine Paper Antitrust Litig., 685 F.2d 810, 817 (3d Cir. 1982) (citations omitted). Although Rule 26 does not establish a specific standard for early or expedited discovery, courts in this District typically apply a “good cause” standard. See Strike 3 Holdings, LLC v. Doe, No. 18-2674, 2020 WL 3567282, at *4 (D.N.J. June 30, 2020) (citations omitted). That inquiry is fact-specific and considers the totality of the circumstances, including whether the need for discovery outweighs any burden or prejudice to the responding party. Relevant factors include: (1) the timing of the request in relation to the normal start of discovery; (2) whether the discovery sought is narrowly tailored; (3) the purpose of the request; (4) the burden on the responding party; and (5) whether the requested discovery can reasonably be provided on an expedited basis. Id. (citations omitted). No single factor is dispositive, and courts are guided by practical considerations of fairness and efficiency.

III. DISCUSSION

Plaintiff seeks expedited discovery for the limited purpose of identifying all individuals involved in the theft of his cryptocurrency and tracing the current location of the stolen assets. (Pl.‘s Mot. for Expedited Disc., ECF No. 5 at 2). To accomplish that, Plaintiff proposes serving narrowly tailored discovery requests on the Individual Defendants concerning the theft, wallet addresses used, and any transfers of the Stolen Assets. Plaintiff also seeks to depose each Individual Defendant for no more than two hours by remote video. In addition, Plaintiff seeks expedited discovery from the Relief Defendants—five cryptocurrency exchanges where forensic analysis has traced deposits of Plaintiff‘s stolen assets—limited to identifying information about the accounts receiving those deposits, their associated communications, and technical metadata such as IP addresses and login information. (Id. at 3–4).

Plaintiff‘s request is timely. Waiting for a Rule 26(f) conference would risk further dissipation of the assets, which Plaintiff has already shown were subject to money laundering tactics, including “peel chaining” and splitting across multiple wallets. (Ex. B. ECF No. 2-2 at 13–32). Delay would significantly prejudice Plaintiff‘s ability to recover his property.

The requested discovery is also narrowly drawn. Plaintiff has identified the specific transactions and wallet addresses at issue, and he seeks only the information necessary to confirm who controls those accounts and where the stolen funds have gone. (Pl.‘s Mot. for Expedited Disc., ECF No. 5 at 3–4). He further limits the scope of depositions and proposes remote proceedings to minimize burden. (Id.).

The purpose of the requested discovery is straightforward: to identify the individuals responsible for the theft and to trace the Stolen Assets to their present locations. Without this information, Plaintiff cannot frame effective preliminary injunctive relief or pursue recovery of his assets. Courts have recognized that in cases involving anonymous actors and cryptocurrency fraud, expedited discovery may be the only means of obtaining the information necessary to proceed. See Strivelli v. Doe, No. 22-2060, 2022 WL 1082638, at *2 (D.N.J. Apr. 11, 2022). The discovery sought here serves precisely that function.

The Court also finds that the burden on Defendants and Relief Defendants is slight. The Relief Defendants are large, well-resourced VASPs accustomed to subpoenas and regulatory inquiries, and the requests are focused on readily accessible customer and account records. Id. (permitting expedited discovery from exchanges to identify actors in a cryptocurrency fraud scheme). As for the Individual Defendants, the limited document requests and brief depositions are proportionate to the seriousness of the allegations and necessary to preserve evidence.

The final factor considers whether the requested discovery can reasonably be provided on an expedited basis. The Court acknowledges that the Relief Defendants are sophisticated financial service providers accustomed to handling legal process, and the requests are targeted to specific transactions. Even so, the Court has some concern that Plaintiff‘s proposed ten-day turnaround may not be practical given the nature and volume of records sought. To balance Plaintiff‘s need for speed with the responding parties’ ability to comply, the Court will reasonably extend the response deadlines set forth in Plaintiff‘s proposed order.

Considering the totality of the circumstances, the Court finds good cause to grant Plaintiff‘s Motion and authorize the requested expedited discovery.

* * * * *

For the foregoing reasons,

IT IS HEREBY on this 28th day of August, 2025,

ORDERED that Plaintiff‘s Motion, (ECF No. 5), is GRANTED. Plaintiff may serve requests for the production of documents to the Individual Defendants concerning: (i) the theft, misappropriation, or transfer of the Stolen Assets; (ii) Wallet addresses receiving the Stolen Assets; (iii) transfers to any exchanges, wallets, or persons; and (iv) the use of the BTC and SOL at issue. All responses and document productions must be served and produced within fourteen days of service of the discovery; and it is further

ORDERED that Plaintiff may take the deposition of each Individual Defendant, limited to two (2) hours each, to be conducted remotely via video conference. The depositions are to be completed within fourteen days of the date of this Order; and it is further

ORDERED that Plaintiff may serve written discovery requests on the Relief Defendants on the following topics: All information related to the identity of the party or parties which initiated the BTC and SOL deposits identified at Exhibit B, (ECF No. 2-2 at 13–32), including but not limited to: (i) account opening and closing material, and communications with the VASP; (ii) the identity of the account holder including any proof of identification; (iii) contact information for the account holder, including addresses, phone, and email; (iv) all documents related to any accounts or transactions associated with the account holder, including the contents of the accounts, transaction hashes, and the account‘s links to external institutions (on and off ramps); and (v) information concerning the account holder‘s access to the VASP, including IP addresses, login and logout information, device IDs and “digital footprint” data; and it is further

ORDERED that the Relief Defendants shall respond to Plaintiff‘s discovery requests within fourteen calendar days; and it is finally

ORDERED that the Relief Defendants shall refrain from notifying any party or parties which initiated the BTC and SOL deposits identified at Exhibit B, (ECF No. 2-2 at 13-32), of Plaintiff‘s discovery requests until further Order of this Court.

CHRISTINE P. O‘HEARN

United States District Judge

Case Details

Case Name: BELLIS v. KELLY

Court Name: District Court, D. New Jersey

Date Published: Aug 28, 2025

Citations: 797 F.Supp.3d 431; 1:25-cv-14917

Docket Number: 1:25-cv-14917

Court Abbreviation: D.N.J.