Case Information
UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA PATRICK KIPPES, Case No. 25-cv-03616-SVK Plaintiff, ORDER ON PLAINTIFF'S EX PARTE APPLICATION TO SERVE THIRD- v. PARTY SUBPOENAS PRIOR TO A RULE 26(F) CONFERENCE DOES 1-25, Re: Dkt. No. 13 Defendant.
Plaintiff Patrick Kippes alleges that he lost approximately $200,000 in cryptocurrency as
the result of a financial scam in which he was misled into trading on a fake cryptocurrency exchange. See Dkt. 11 (First Amended Complaint). Plaintiff claims that he does not know the identities of the Doe Defendants, who are “persons and entities who contacted Plaintiff using an alias, set up and ran the fake exchange, communicated with Plaintiff through a fake website, and refused to release his deposits.” Id. ¶ 7. Now before the Court is Plaintiff’s ex parte application for leave to serve subpoenas on a number of third parties in an attempt to ascertain the identity of the Doe Defendants. Dkt. 13. This matter is suitable for determination without a hearing. Civ. L.R. 7-1(b). For the reasons that follow, the Court GRANTS IN PART Plaintiff’s leave to serve third-party subpoenas. Plaintiff may serve subpoenas on the entities identified in his motion, but the subpoenas must be limited to seeking certain account holder and account balance information and must give the subpoena recipients an opportunity to object to or move to quash or modify the subpoenas.
I. BACKGROUND [1]
In late 2024, Plaintiff, who resides in this District, was contacted through LinkedIn by someone who identified themselves as “Vicky Wang,” who claimed to be a financial executive for Southwest Airlines and BlackRock Financial. Dkt. 11 ¶¶ 17, 20, 21; Dkt. 13-2 ¶ 4. Wang also contacted Plaintiff through Plaintiff’s WhatsApp and iMessage accounts. Dkt. 11 ¶ 22; Dkt. 13-2 ¶¶ 5-7. After about four months of attempted communications from Wang, Plaintiff responded. Dkt. 11 ¶ 23; Dkt. 13-2 ¶ 8. Wang discussed with Plaintiff using centralized “Web 3.0” platforms to earn returns on trading cryptocurrency and provided screenshots of her portfolio showing high returns. Dkt. 11¶¶ 24-25; Dkt. 13-2 ¶ 10.
In February 2025, Plaintiff decided to try some trades, and Wang directed Plaintiff to a trading platform called “Raydium Pro,” which Plaintiff claims he believed was associated with the legitimate exchange Raydium.io. Dkt. 11 ¶¶ 26-28; Dkt. 13-2 ¶ 12. Between February 12, 2025 and February 27, 2025, as directed by Wang, Plaintiff deposited 1.649644284 Bitcoin to two addresses on the bitcoin blockchain: 3AsBsxRhhftwXDTKRmKYCjYsJFq1HPYUc1 and 3JCD69qMZiKKX6PQ15Vx2NTPJTd9AU4vtR. Dkt. 11 ¶ 29; Dkt. 13-2 ¶ 14. On February 26, 2025, Plaintiff was able to withdraw $490 from his account. Dkt. 11 ¶ 30; Dkt. 13-2 ¶ 15. In that timeframe, Plaintiff was also able to access records on the allegedly fake exchange site that showed his investment was growing. Dkt. 11 ¶ 31; Dkt. 13-2 ¶ 17. On March 2, 2025, Plaintiff deposited 62,067.96 USDC, another form of cryptocurrency, to an address on the Ethereum blockchain: 0x2eAb6129aFf80e301A52432bf6f8a010b3d7760e. Dkt. 11 ¶ 34; Dkt. 13-2 ¶ 16. On March 1, 2025, Plaintiff tried to withdraw approximately $342,000 of his digital assets, but his account showed the transaction was “under review.” Dkt. 11 ¶¶ 32-33; Dkt. 13-2 ¶ 18. Plaintiff was informed by the exchange that he would have to deposit additional funds to proceed with his withdrawal. Dkt. 11 ¶ 35; Dkt. 13-2 ¶ 19. At this point, Plaintiff realized he had been the victim of a fraud. Dkt. 11 ¶ 36; Dkt. 13-2 ¶ 20.
Plaintiff retained a company that tracks digital assets to help him recover his cryptocurrency. Dkt. 11 ¶ 37; Dkt. 13-1 ¶ 21; see also Dkt. 13-4. The company concluded that Plaintiff’s assets had been moved through numerous accounts (the “Destination Addresses”) on cryptocurrency exchanges Coinbase, Kraken, Crypto.com, HitBtc, and Changelly (the “Virtual Asset Service Providers” or “VSAPs”). Dkt. 11 ¶ 38; see also Dkt. 13-4 ¶¶ 13-24. 26 On April 24, 2025, Plaintiff filed the original complaint in this action. Dkt. 1. On May 28, 27 2025, the Court issued an Order to Show Cause that required Plaintiff to demonstrate that this Court has subject matter jurisdiction. Dkt. 10. Thereafter, Plaintiff filed the First Amended Complaint, which contains additional information about the citizenship of the Parties and the 1 amount in controversy, and the Court discharged the Order to Show Cause. Dkt. 11, 12. 2 The First Amended Complaint contains several causes of action including fraud, conversion, 3 money had and received, unjust enrichment, and constructive trust. Dkt. 11. 4 II. LEGAL STANDARD 5 Federal Rule of Civil Procedure Rule 26(d) provides that absent a court order, no discovery
6 can be sought “from any source before the parties have conferred as required by Rule 26(f).” 7
Fed. R. Civ. P. 26(d)(1). District courts within the Ninth Circuit generally require a showing of 8
good cause for early discovery. See Strobel v. Lesnick, No. 21-cv-01010-LB, 2021 WL 5121171, 9 at *2 (N.D. Cal. Nov. 1, 2021) (collecting cases). “Good cause may be found where the need for 10 expedited discovery, in consideration of the administration of justice, outweighs the prejudice to 11 the responding party.” Semitool, Inc. v. Tokyo Electron Am., Inc. , 208 F.R.D. 273, 276 (N.D. Cal. 2002). In determining whether good cause exists, courts consider: “(1) whether a preliminary injunction is pending; (2) the breadth of the discovery request; (3) the purpose for requesting the expedited discovery; (4) the burden on the defendants to comply with the requests; and (5) how far in advance of the typical discovery process the request was made.” Rovio Ent. Ltd. v. Royal Plush Toys, Inc. , 907 F. Supp. 2d 1086, 1099 (N.D. Cal. 2012). Under appropriate circumstances, California district courts have found good cause to authorize early discovery to ascertain the identity of an unknown defendant. See, e.g., JustM2J
LLC v. Brewer , No. 2:25-cv-00380-DAD-SCR, 2025 WL 435827, at *10-11 (E.D. Cal. Feb. 7, 2025) (authorizing early third-party subpoenas to identify the identity of Doe defendants in a case alleging that cryptocurrency assets were lost as a result of cyberattacks); AF Holdings LLC v. Doe , No. 2:12-cv-02207-KJM-DAD, 2012 WL 6608993, at *1 (E.D. Cal. Dec. 18, 2012) (granting leave to conduct expedited discovery to determine the identity of a Doe defendant in a copyright infringement action); First Time Videos, LLC v. Doe , No. 2:12- cv-00621-GEB-EFB, 2012 WL 1355725 (E.D. Cal. Apr. 18, 2012) (same); UMG Recordings, Inc. v. Doe , No. 08-cv-03999- RMW, 2008 WL 4104207 (N.D. Cal. Sept. 4, 2008) (same); Arista Recs. LLC v. Does 1– 43 , No. 07-cv-02357-LAB-POR, 2007 WL 4538697 (S.D. Cal. Dec. 20, 2007) (same). Moreover, the Ninth Circuit has held that “‘where the identity of the alleged defendant[ ] [is] not [ ] known prior to the filing of a complaint[,] the plaintiff should be given an opportunity through discovery to identify the unknown defendants, unless it is clear that discovery would not uncover the identities, or that the complaint would be dismissed on other grounds.’” Wakefield v. Thompson , 177 F.3d 1160, 1163 (9th Cir. 1999) (alteration in original) (quoting Gillespie v. Civiletti , 629 F.2d 637, (9th Cir. 1980)).
To determine whether a plaintiff has established good cause to seek the identity of a Doe defendant through early discovery, courts consider whether the plaintiff (1) identifies the Doe defendant with sufficient specificity that the Court can determine that the defendant is a real person who can be sued in federal court, (2) recounts the steps taken to locate and identify the defendant, (3) demonstrates that the action can withstand a motion to dismiss, and (4) shows that the discovery is likely to lead to identifying information that will permit service of process. Columbia Ins. Co. v. seescandy.com , 185 F.R.D. 573, 578–80 (N.D. Cal. 1999); see also Strobel, 2021 WL 5121171, at *2.
III. DISCUSSION Plaintiff’s present motion for leave to serve third-party subpoenas prior to a Rule 26(f) conference seeks leave to serve subpoenas on the following categories of third parties in an effort to identify the Doe Defendants: (1) virtual asset service providers Coinbase, Kraken, Crypto.com, HitBtc, and Changelly (collectively, the “VSAPs”) associated with the Destination Addresses to which the asset recovery company retained by Plaintiff has traced the assets deposited by Plaintiff; (2) social media and messaging platforms LinkedIn, WhatsApp, and iMessage (Apple), through which “Vicky Wang” contacted Plaintiff (collectively, the “Social Media/Networking Platforms”); and Internet Service Providers Bandwith.com and T-Mobile (collectively, the “ISPs”), which are associated with the telephone numbers used by “Vicky Wang” to communicate with Plaintiff. Dkt. 13; Dkt. 13-1; Dkt. 13-2; Dkt. 13-4.
In considering whether Plaintiff has established good cause to conduct this early discovery under the relevant Rovio factors, the Court concludes that good cause exists for Plaintiff to serve subpoenas on each category of third parties but that the scope of information Plaintiff seeks to obtain is overly broad.
A. Whether a preliminary injunction is pending
Plaintiff has not yet filed a motion for preliminary injunction. However, Plaintiff has adequately shown that he needs additional information about the identity of the Doe Defendants to establish the factors that would support a motion for a temporary restraining order or preliminary injunction. See Dkt. 13 at 7.
B. Purpose for the requested discovery
The purpose for requesting early discovery is an attempt by Plaintiff to identify the unknown defendants. As explained in section II above, to determine whether a plaintiff has established good cause to seek the identity of an unknown defendant through early discovery, courts consider the seescandy.com factors. See JustM2J, 2025 WL 435827, at *10. Here, Plaintiff retained a cryptocurrency investigator in an effort to trace the assets deposited by Plaintiff. See Jacobo v. Doe, No. 1:22-cv-00672-DAD-BAK (BAM), 2022 WL 2079766, at *3 (E.D. Cal. June 9, 2022) ( “Jacobo II ”) (finding first seescandy.com element met where plaintiff “recounts the use of blockchain analytics to trace the path of her stolen assets and identified a number of cryptocurrency wallet addresses (‘Destination Addresses’) at the Exchanges to which her assets have been transferred without her consent”). Plaintiff’s communications with “Vicky Wang” indicate that the identity of the Doe Defendant to whom Plaintiff transferred cryptocurrency assets “is likely already known or ascertainable.” See Jacobo II, 2022 WL 2079766, at *3. Moreover, through Plaintiff’s effort to trace his cryptocurrency assets, Plaintiff has identified specific wallet addresses held by specific VSAPs, which should enable the identification of additional Doe Defendants. See generally Dkt. 13-4. The information Plaintiff seeks regarding ownership of these accounts “is reasonably likely to lead to the production of information that will permit plaintiff to serve process.” Jacobo II, 2022 WL 2079766, at *3. Plaintiff has also demonstrated that the action can withstand a motion to dismiss. See generally Jacobo v. Doe, No. 1:22-cv- 00672-DAD-BAK (BAM), 2022 WL 2052636, at *4-5 (E.D. Cal. June 7, 2022) (“ Jacobo I ”) (on motion for temporary restraining order, finding that alleged victim of similar cryptocurrency scam was likely to succeed on the merits of conversion claim); Jacobo II, 2022 WL 2079766, at *3 (on motion for expedited discovery, finding that likelihood of success on conversion claim satisfied seescandy.com criteria). Accordingly, the third Rovio factor, which considers the purpose for requesting early discovery, supports a finding of good cause because early discovery is an appropriate method of attempting to identify unknown defendants where, as here, the seescandy.com factors are met. See JustM2J, 2025 WL 435827, at *10.
C. Burden on defendants The discovery sought by Plaintiff will not impose a burden on the Doe Defendants because
at this juncture the Court is only authorizing Plaintiff to serve subpoenas on the third-party VSAPs, Social Media/Messaging Platforms, and ISPs. Moreover, the Court’s order will ensure that the return date on the subpoenas will give the subpoena recipients an opportunity to object to or file a motion to quash or modify the subpoenas and therefore gives them an opportunity to raise any issues regarding the burden imposed by the subpoenas. See JustM2J, 2025 WL 435827, at *10.
D. Timing of request for early discovery
Plaintiff’s request to conduct early discovery does not raise any concerns under the Rovio factor that considers how far in advance of the typical discovery process the request was made. Plaintiff made the request early in the litigation. As a practical matter, this case cannot proceed to a Rule 26(f) conference until the Doe Defendants are identified, added to the case, served, and appear. E. Breadth of discovery The remaining Rovio factor considers the breadth of the discovery request. In an effort to identify the account holder(s) of each of the VSAP accounts identified by the asset recovery company retained by Plaintiff and the social media accounts, messaging accounts, and telephone numbers through which “Vicky Wang” contacted Plaintiff, Plaintiff appropriately seeks the account holders’ name, address, phone number, and email address. See Dkt. 13-3 ¶ 2; see also
Dkt. 13-1; Dkt. 13-2; Dkt. 13-4. Plaintiff has not at this time demonstrated good cause for his request to seek additional account holder information, such as “know your customer (KYC) and anti-money laundering (AML) information” from the VSAPs, “device identifiers and registrations” from the Social Media/Messaging Platforms, or “device identifiers” from the ISPs. See Dkt. 13-3 (Plaintiff’s proposed order) ¶¶ 2, 5, 7.
Plaintiff also has not at this time demonstrated good cause to seek all “transaction records of deposits and withdrawals” from the VSAPs, “network and access logs” and” from the Social Media/Messaging Platforms, or “network and access logs” and from the ISPs. See id . Other district courts in the Ninth Circuit have “declined to broaden the scope of expedited discovery to transaction information, even when a plaintiff contends … that it needs this information to prevent asset dissipation.” JustM2J, 2025 WL 435827, at *11 (collecting cases); see also Rambod v. Defendant 1, No. 2:24-cv-07215-SVW-BFM, 2024 WL 5673308, at *3 (C.D. Cal. Nov. 5, 2024) (authorizing subpoena seeking names and physical addresses of account holders but not other identifying information or transaction or account balance information); Jacobo II, 2022 WL 2079766, at *4 (finding that plaintiff failed to narrowly tailor expedited discovery requests where requests sought information beyond information about account owner, such as information regarding transactions involving the accounts). The Court agrees with this distinction and denies Plaintiff’s attempt to seek general transaction information and network and access logs at this time. See Dkt. 13 at 11-12; Dkt. 13-3 ¶ 8. This limitation is especially appropriate in light of Plaintiff’s request that the subpoena recipients be prohibited from notifying the account holders of the subpoenas, which will prevent the account holders from objecting to Plaintiff’s request for transaction information. Although the Court will not allow Plaintiff to seek general transaction information at this
time, the Court will permit Plaintiff to ask for the balances of the VSAP accounts identified in his motion. District courts within the Ninth Circuit have reached different results on the issue of whether subpoenas aimed at identifying unknown defendants involved in cryptocurrency scams should be allowed to seek information about account balances. Compare Salem v. Defendant “1,” No. 2:24-cv-07079-JAK (RAOx), 2025 WL 1039396, at *1 (C.D. Cal. Jan. 22, 2025) (authorizing subpoenas to cryptocurrency exchanges that sought account balances) with Rambod, 2024 WL 5673308, at *3 (declining to authorize portion of proposed subpoenas to cryptocurrency exchanges that sought account balances). More generally, however, courts in other cases have recognized that cryptocurrency like that at issue in this case “poses a heightened risk of asset dissipation.” JustM2J , 2025 WL 435827, at *6 (citations omitted); see also Jacobo I , 2022 WL 2052637, at *10-11 (granting temporary restraining order, finding that “the fact that the assets at issue here are held in cryptocurrency weigh in favor the granting of injunctive relief and a freezing of the assets because there is a high risk of asset depreciation with cryptocurrency” (citation omitted)). These courts have signaled that whether a defendant has begun liquidating cryptocurrency assets is relevant to whether the plaintiff is entitled to a temporary restraining order. JustM2J, 2025 WL 435827, at *9 (denying temporary restraining order and distinguishing Jacobo I on the issue of irreparable harm because “[u]nlike in [ Jacobo I ], there is no indication that defendants have begun liquidating cryptocurrency assets”). Allowing Plaintiff to obtain information about the balances of the identified cryptocurrency accounts, while also precluding Plaintiff from seeking more detailed transaction information at this time, strikes the appropriate balance between Plaintiff’s need for information in connection with his stated intention to seek asset-freezing injunctive relief ( see Dkt. 13 at 12) and any prejudice to the Doe Defendants.
F. Conclusion on Rovio factors
After considering the relevant factors, the Court finds good cause to permit Plaintiff to serve subpoenas on the third-party VSAPs, Social Media/Messaging Platforms, and ISPs that are limited to seeking basic identifying information regarding holders of the relevant accounts and the account balances of the accounts identified in Plaintiff’s motion and that comply with the additional requirements set forth below. G. Notice to Doe Defendants
that the subpoena recipients (i.e., the third-party VSAPs, Social Media/Messaging Platforms, and ISPs identified in Plaintiff’s motion) refrain from notifying their customers (i.e., account holders/users) about the subpoenas, citing two cases in which Plaintiff claims courts have issued temporary restraining orders on an ex parte could be dissipated. Dkt. 13 at 11-12. basis because of the risk that cryptocurrency assets [2] Most courts that have authorized early discovery in an effort to identify Doe defendants in cryptocurrency cases have required cryptocurrency exchanges Plaintiff requests that if the Court authorizes the issuance of subpoenas, the Court order to notify their account holders/users of the subpoenas. See, e.g., JustM2J, 2025 WL 435827, at *11; Jacobo II, 2022 WL 2079766, at *4; ZG TOP Tech. Co. Ltd. v. Doe , No. C19-92-RAJ, 2019 WL 917418, at *2 (W.D. Wash. Feb. 25, 2019). However, because of the concerns discussed in section III.E. about the possible risk of asset dissipation before Plaintiff is in the position to bring a motion for temporary restraining order and because the Court has narrowed the scope of information Plaintiff is authorized to seek by the subpoenas, the Court will grant Plaintiff’s request that the third-party subpoena recipients be instructed not to notify account holders/users of the 1 subpoenas. This ruling does not preclude the subpoena recipients from seeking Plaintiff’s consent 2 or the Court’s permission to notify their account holders/users of the subpoenas, if appropriate. 3 This ruling also does not excuse Plaintiff from making the necessary showing if he ultimately 4 seeks a temporary restraining order on an ex parte basis. 5 IV. CONCLUSION
6 For the reasons explained above, Plaintiff’s motion for leave to serve third-party subpoenas 7 prior to the Rule 26(f) conference is GRANTED IN PART as follows: 8
1. Plaintiff may promptly serve Rule 45 subpoenas on the VSAPs, Social Media/Messaging Platforms, and ISPs identified in Plaintiff’s motion for leave that are limited to seeking the following information about the holders of the accounts identified in the motion: legal name, street address, telephone number, and email address. The subpoenas to the VSAPs may also seek the account balances of the accounts identified in the motion. The subpoenas may not seek any other information including but not limited to Social Security numbers, Know Your Customer or Anti-Money Laundering information, transaction information, network and access logs, or device identifiers or registrations. Each subpoena must attach a copy of this order. 2. The return date on each subpoena shall be NO LESS THAN 14 DAYS from the date of service on the subpoena recipient. Each subpoena recipient shall have until the return date on the subpoena to object to the subpoena and/or file a motion to modify or quash the subpoena, pursuant to Federal Rule of Civil Procedure 45.
3. The subpoena recipient shall preserve any information responsive to the subpoena
23
pending the resolution of any timely-filed motion to quash, modify, or compel 24 compliance with the subpoena.
25 4. The subpoena recipient shall refrain from notifying any of the account holders 26 or users whose information has been subpoenaed until further order of the 27 Court. 5. Plaintiff and his counsel may use any information produced pursuant to the
subpoenas authorized by this order only in this litigation. Pending further order of 1 the Court, Plaintiff and his counsel shall maintain all information received in 2 response to the subpoenas as “Confidential” in accordance with the Court's model 3 protective order for standard litigation, available here: 4 https://cand.uscourts.gov/wp-content/uploads/forms/model-protective- 5 orders/CAND_StandardProtOrd.Feb2022.pdf Plaintiff must seek leave of Court before serving subpoenas other than those authorized in this order prior to a Rule 26(f) conference.
SO ORDERED. Dated: August 7, 2025
SUSAN VAN KEULEN United States Magistrate Judge
[1] This factual background is based primarily on the allegations of Plaintiff’s First Amended Complaint (Dkt. 11) and Plaintiff’s declaration filed in support of the present motion (Dkt. 13-2).
[2] One of the two cases cited by Plaintiff— Jacobo II , 2022 U.S. Dist. LEXIS 10370, at *10, 2022 WL 2079766—does not concern a temporary restraining order and does not include the language quoted in Plaintiff’s brief. In fact, in Jacobo II , the court ordered that cryptocurrency account holders were to be notified when subpoenas were issued to cryptocurrency exchanges holding their accounts. Id. , 2022 WL 2079766, at *4. However, that order followed an earlier order in the case that granted the plaintiff an ex parte TRO and contained the language quoted in Plaintiff’s brief regarding the risk of asset dissipation. Jacobo I , 2022 WL 2052637, at *3.