ORDER GRANTING PLAINTIFF‘S REDACTED SECOND MOTION FOR PRELIMINARY INJUNCTION

Before the Court is Plaintiff‘s Redacted Second Motion for Preliminary Injunction. [Dkt. 47]. On May 23, 2025, the Court granted Plaintiff‘s request for a 14-day Temporary Restraining Order (“TRO“) freezing six blockchain addresses that he alleges received assets that were stolen from him by the defendants in this matter. [Dkt. 35]; see [Dkt. 38 (redacted version)]. The Court subsequently extended that TRO for another 14 days. [Dkt. 40]. Plaintiff now seeks to extend this asset freeze through trial. On June 20, 2025, the Court granted the Motion for Preliminary Injunction in a sealed order. [Dkt. 48]. This document is the redacted public version of that order.

The Court analyzed Plaintiff‘s Motion, held a hearing, and reviewed submitted evidentiary materials. For the reasons set out below, Plaintiff‘s Motion is hereby GRANTED.

I. BACKGROUND

Plaintiff‘s relevant allegations are as follows. In June 2024, he met a person claiming to be named Anna Popescu on a dating website. [Dkt. 36 at ¶ 17]. Popescu eventually told Plaintiff about her success investing and trading cryptocurrencies and introduced him to a platform called TrustHFTwallet. Id. at ¶ 18. Popescu told Plaintiff that she knew how to make profits using TrustHFTwallet and offered to teach him how to do the same. Id. She encouraged him to make a TrustHFTwallet account, which he soon did. Id.

Over the next several months, Popescu “trained” Plaintiff in cryptocurrency trading using the TrustHFTwallet platform. Id. at ¶ 19. When Plaintiff was ready to make a deposit on TrustHFTwallet, the platform provided him asset-transfer instructions via its mobile application. Id. Plaintiff completed the transactions as instructed. Id. Each time, the amount of funds he “deposited” would then be reflected in his transaction history and account balance on the TrustHFTwallet platform. Id. Over time, he sent assets to TrustHFTwallet with a dollar-denominated value of more than $2,400,000.00. Id.

Plaintiff‘s balance on the TrustHFTwallet platform appeared to grow rapidly—eventually showing that he had crypto assets worth more than $4.5 million in his account. Id. at ¶ 20. But when he attempted to withdraw his funds, TrustHFTwallet informed him that he could not do so in significant quantities without “leveling up” his account by depositing more money. Id. Plaintiff realized that he had been scammed. Id.

At the outset of this case, Plaintiff‘s investigator produced a “blockchain tracing” report. This “tracing” refers to the process of following digital assets from location to location on the blockchain via publicly available data. [Dkt. 47-1 at Exhs. 1-C, 1-D]. Plaintiff‘s investigator was able to trace his allegedly stolen assets to a deposit address associated with the [REDACTED] cryptocurrency exchange. The Court therefore authorized Plaintiff to issue a subpoena to [REDACTED]. [Dkt. 6]. In response, [REDACTED] produced documents identifying the individual owner of the [REDACTED] Receiving Account: [REDACTED] [REDACTED]. [Dkt. 47-1 at Ex. 1-D].

Plaintiff alleges that [REDACTED] is a participant in the criminal syndicate that victimized him. [Dkt. 36 at ¶¶ 31–33]. Specifically, he alleges that [REDACTED]‘s role was to receive the assets stolen from Plaintiff after they had been “hopped” through intermediary addresses, and then transfer those assets onward to additional addresses controlled by the Defendants. Id. at ¶ 30. By analyzing [REDACTED]‘s outgoing transaction history, Plaintiff alleges that he was able to trace his assets to six blockchain addresses where they were ultimately deposited, and where they remain to this day (the “Target Addresses“). Id. at ¶ 33. The Target Addresses are:

[REDACTED]
[REDACTED]
[REDACTED]
[REDACTED]
[REDACTED]
[REDACTED]

Id. at ¶ 13. The cryptocurrency held at these addresses is called U.S. Dollar Coin (“USDC“). Plaintiff alleges that Circle Internet Group, Inc. (“Circle“)—the organization that created and manages the USDC currency—has the ability to blacklist blockchain addresses holding USDC and thereby effectively “freeze” the USDC at those addresses. Id. at ¶ 13; [Dkt. 47-1 at ¶¶ 13–14].

Plaintiff reports that Circle has in fact implemented a freeze of these addresses in response to the Court‘s prior TRO. He now seeks a preliminary injunction that would extend the Court‘s freezing order through trial.

II. ANALYSIS

Plaintiff has met the requirements for issuance of a Preliminary Injunction.

First, Plaintiff has shown that he supplied the Defendants with notice of his Second Motion for Preliminary Injunction and this hearing as required under Federal Rule of Civil Procedure 65(a)(1). The Cole Declaration describes the methods used to provide notice to the Defendants here.¹ [Dkt. 47-1 at ¶¶ 15–17].

Next, Plaintiff has met the substantive requisites for issuance of a preliminary injunction. To obtain a preliminary injunction, the movant must show (1) a substantial likelihood of success on the merits, (2) a substantial threat of irreparable harm if the injunction does not issue, (3) that the threatened injury outweighs any harm that will result if the injunction is granted, and (4) that the grant of an injunction is in the public interest. Moore v. Brown, 868 F.3d 398, 402–03 (5th Cir. 2017) (citation omitted). Each of these requisites is addressed in turn below.

A. Likelihood of Success on the Merits

Plaintiff makes claims against the Defendants for violation of the Racketeering Influenced and Corrupt Organizations Act (“RICO“), fraud, and conversion.² He has alleged and provided evidence that the Defendants deceived him and misappropriated his assets in what appears to have been an intentional scam. [Dkt. 36 at ¶¶ 17–35; Dkt. 47-1 at ¶¶ 3–14]. The Court finds, at this stage, that the similarities between Plaintiff‘s allegations and the widely known characteristics of this distinctive kind of scam suggest that he will indeed be able to prevail on these claims once a full evidentiary record is developed.

To prove a civil RICO claim, a plaintiff must show (1) a violation of 18 U.S.C. § 1962, (2) an injury to his business or property, and (3) that the RICO violation caused this injury. Lewis v. Danos, 83 F.4th 948, 956 (5th Cir. 2023). To prove a RICO violation, a plaintiff must show that the defendant is a person engaged in a pattern of racketeering activity, connected to the acquisition, establishment, conduct,

or control of an enterprise. Whelan v. Winchester Prod. Co., 319 F.3d 225, 229 (5th Cir. 2003). Plaintiff‘s evidence describes the Defendants’ “pig-butchering” scam and provides documentation as to how that unfolded. In particular, Mr. Cohn‘s Second Amended Complaint shows how he was deceived into the scam by a person with whom he believed he was developing a personal and even romantic relationship. [Dkt. 36 at ¶¶ 17–21]. Furthermore, Evan Cole‘s Declaration attests as to why Defendants are professional cybercriminals well-versed in these pig-butchering scams that perpetrate a pattern of wire fraud across the globe. [Dkt. 47-1 at ¶¶ 3–9]. As a result of the scam, Mr. Cohn alleges that he lost assets worth more than $2.4 million. [Dkt. 36 at ¶ 4]. Therefore, the Court finds that Mr. Cohn‘s RICO claim is likely to succeed on the merits.

To prove a conversion claim under California law, the plaintiff must show “(1) the plaintiff‘s ownership or right to possession of the property; (2) the defendant‘s conversion by a wrongful act or disposition of property rights; and (3) damages.” Welco Elecs., Inc. v. Mora, 223 Cal. App. 4th 202, 208 (Cal. Ct. App. 2014). The allegations and evidence demonstrate that the Defendants wrongfully and intentionally took control of Mr. Cohn‘s assets and have not returned them. [Dkt. 36 at ¶¶ 17–21; Dkt. 47-1 at ¶¶ 3–9]. In his briefing, Mr. Cohn cited a federal cryptocurrency fraud preliminary injunction that similarly found that the plaintiff was likely to succeed on the merits. See Bullock v. Doe, No. 23-cv-3041, 2023 WL 9503380, at *5 (N.D. Iowa Nov. 3, 2023). Thus, Mr. Cohn is likely to succeed on the merits of his conversion claim.

Finally, to allege a fraud claim under California law, a plaintiff must show (1) the defendant made a misrepresentation, (2) the defendant knew the misrepresentation was false, (3) the defendant‘s intent to defraud, (4) justifiable reliance, and (5) damages. OCM Principal Opp. Fund, L.P. v. CIBC World Mkts. Corp., 157 Cal. App. 4th 835, 845 (Cal. Ct. App. 2007). Similar to conversion, the allegations and evidence have demonstrated that the Defendants intentionally deceived Mr. Cohn and took control of his assets to trade cryptocurrency for profit under the representation that their investments would be legitimate. [Dkt. 36 at ¶¶ 17–21; Dkt. 47-1 at ¶¶ 3–9]. Mr. Cohn relied on these representations in transferring his savings worth about $2,400,000.00 to the Defendants, which he now seeks to recover. Thus, Mr. Cohn is likely to succeed on the merits of his fraud claim.

In addition, as in the previous order granting the extant TRO, the Court notes that asset freeze Plaintiff seeks in this instance is permissible in light of his request for a constructive trust over specific, traceable stolen assets, as several courts have held in analogous cryptocurrency-fraud cases. See, e.g., Yogaratnam v. Dubois, No. CV 24-393, 2024 WL 758387, at *3 (E.D. La. Feb. 23, 2024) (issuing asset-freeze TRO in crypto-fraud case, noting that “numerous district courts … have issued a TRO in this exact circumstance to freeze a cryptocurrency asset,” and collecting cases); Jacobo v. Doe, No. 1:22-CV-00672DADBAKBAM, 2022 WL 2052637, at *3 (E.D. Cal. June 7, 2022) (issuing asset-freezing TRO where plaintiff sought constructive trust over allegedly stolen assets); Gaponyuk v. Alferov, No. 2:23-cv-01317-KJM-JDP, 2023 WL 4670043, at *2 (E.D. Cal. July 20, 2023) (same). Plaintiff‘s claim that his assets can be traced to their present locations is supported by the blockchain analysis submitted in support of his Motion. See [Dkt. 47-1].

B. Irreparable Harm

Plaintiff has also shown that irreparable harm will ensue absent the restraining order he seeks. The assets at issue could be further transferred to unretrievable locations at any time, with the click of a button. [Dkt. 47-1 at ¶ 14]. Several federal courts have found that this exigency justified issuance of freezing orders in similar crypto-fraud cases, and this Court finds their reasoning persuasive here.³

C. Balance of the Hardships

Next, the Court finds that the threatened injury to Plaintiff outweighs any harm the Defendants may suffer by virtue of a freeze of their accounts. The Defendants will suffer at worst a temporary inability to move assets if the injunction is later dissolved. See, e.g., Licht v. Ling, No. 3:23-CV-1018, 2023 WL 4504585, at *3 (N.D. Tex. June 20, 2023) (balancing factor weighed in plaintiff‘s favor because alleged crypto-thieves faced only “inconvenience” of asset-freeze, which could be undone); Jacobo, 2022 WL 2052637, at *6 (same, finding “[a] delay in defendant‘s ability to transfer the [allegedly stolen] assets only minimally prejudices defendant, whereas withholding injunctive relief would severely prejudice plaintiff by providing defendant time to transfer the allegedly purloined assets into other accounts beyond the reach of this court“). In contrast, maintaining the assets at the destination accounts is perhaps Plaintiff‘s only realistic chance at recovery in this case.

D. Public Interest

Finally, the Court finds that issuing the injunction is in the public interest. In fact, in this case, the public interest weighs particularly heavily in favor of the requested injunction. Plaintiff‘s evidence shows that the devastation wrought by the pig-butchering epidemic is breathtaking. [Dkt. 47-1 at ¶¶ 6–9]. The FBI reports that in 2024 alone, tens of thousands of American victims lost more than $5 billion to cryptocurrency-related investment scams. Id. The public interest overwhelmingly favors preserving victims’ only potential source of recovery through the issuance of preliminary injunctive relief. As other courts have noted, issuing the relief requested will “provide[] assurance to the public that courts will take action to promote … recovery of stolen assets when they can be readily located and traced to specific locations.” Jacobo, 2022 WL 2052637, at *6 (cleaned up) (citation omitted).

III. PRELIMINARY INJUNCTION

Plaintiff has submitted evidence tracing the assets he alleges were stolen from him the Target Addresses, which are:

[REDACTED]
[REDACTED]
[REDACTED]
[REDACTED]
[REDACTED]
[REDACTED]

For the reasons set out in the Motion, the Court finds that these deposit addresses should be frozen. Accordingly, the Court hereby ORDERS that Defendants and their agents, servants, employees, attorneys, partners, successors, assigns, and all other persons or entities through which they act or who act in active concert or participation with any of them, who receive actual notice of this Order by personal service or otherwise, whether acting directly or through any trust, corporation, subsidiary, division or other device, or any of them, are hereby restrained from withdrawing, transferring, or encumbering any assets currently held by, for, or on behalf of the persons controlling the accounts associated with the above-listed Target Addresses, or any business entity through which they act or which acts in active concert or participation with them; including but not limited to those assets currently held at or for the Target Addresses.

The Court ORDERS that Plaintiff shall cause a copy of this Order to be served on the above-listed entities in a manner compliant with Rule 4 or as the Court may further direct. Upon receiving a copy of this Order, these entities shall be restrained and enjoined from disturbing assets, directly or indirectly, to or on behalf of Defendants or any entities under Defendants’ control. Additionally, the Court ORDERS that all movement, alteration, or destruction of books, records, and accounts related to the above-listed blockchain addresses is prohibited. The Court declines to impose a bond.

The preliminary injunction set out in this Order shall continue until trial or further order of the Court.

SIGNED this 25th day of June, 2025.

Michael J. Truncale

United States District Judge

Notes

During the hearing, the Court made sure that Plaintiff properly notified Defendants of his motion and hearing setting. Cole‘s affidavit indicates that he sent notice to [REDACTED] via the email he used to registered his [REDACTED] account. [Dkt. 47-1 at ¶ 16]. Additionally, he sent a Non-Fungible Token (“NFT“) to each of the six Target Addresses. Id. at ¶ 17, p. 84. As explained by Plaintiff‘s counsel at the hearing, an NFT is essentially a digital file, similar to sending someone a digital image of a painting. As to Popescu and TrustHFTwallet, counsel represented that both entities and their methods of communication disappeared. Finally, Plaintiff issued summons to Newman and Zedxion [Dkt. 24], thereby meaning that these Defendants could actively track the docket. Rule 65(a)(1) “does not require service of process, but rather requires notice to the adverse party.” (cleaned up) (quoting ). The Court finds sufficient evidence that demonstrates Plaintiff used reasonable means to notify Defendants of the hearing.

Plaintiff also raises an aiding and abetting conversion and fraud claim against some of the Defendants. [Dkt. 36 at pp. 16–19]. “To obtain a preliminary injunction, first the movants must show that they are likely to succeed on the merits of at least one of their claims.” (citing , appeal dismissed sub nom. ). The Court finds that Plaintiff‘s likelihood of success on at least one of his claims fulfills this element of a preliminary injunction.

See, e.g., (“Considering the speed with which cryptocurrency transactions are made as well as the anonymous nature of those transactions, it is imperative to freeze the Destination Addresses to maintain the status quo to avoid dissipation of the money illegally taken from Plaintiffs.“); (“Because it would be a simple matter for [defendant] to transfer [the] cryptocurrency to unidentified recipients outside the traditional banking system and effectively place the assets at issue in this matter beyond the reach of the court, the court finds that plaintiff is likely to suffer immediate and irreparable harm in the absence of injunctive relief.“) (cleaned up); (same).

Read the detailed case summary