IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLORADO

Civil Action No. 25-cv-03129-DDD-KAS

Y.S.,

Plaintiff,

v.

JOHN DOE et al.,

Defendants. _____________________________________________________________________

ORDER _____________________________________________________________________ ENTERED BY MAGISTRATE JUDGE KATHRYN A. STARNELLA

This matter is before the Court on Plaintiff’s Amended Motion for Expedited Discovery [#46] (the “Motion”). The Motion [#46] has been referred to the undersigned. See Order Referring Motion [#47]. The Court has reviewed the Motion [#46], the entire case file, and the applicable law. For the following reasons, the Court GRANTS in part and DENIES in part the Motion [#46]. I. Background This is a cryptocurrency theft case where defendants’ identities remain unknown. Plaintiff requests expedited discovery to issue subpoenas on certain nonparties to uncover the defendants’ identities. See Motion [#46]. Plaintiff previously filed a series of Motions [#3, #10, #12] and Supplements [#21, #24, #40] requesting this same relief. However, the Court denied without prejudice Plaintiff’s prior requests because he failed to demonstrate that his proposed subpoenas were narrowly tailored and further failed to explain why certain nonparties possessed the relevant identifying information. See Order [#45]. The Court instructed Plaintiff that, should he continue to seek early discovery, he may file a single, amended motion for expedited discovery. Id. at 14. The Court further instructed Plaintiff that if he chose to file an amended motion he must: (1) narrowly tailor his request for only the information needed to uncover the defendants’ identities and (2)

identify no more than three third parties that he wishes to serve, and explain why those third parties are likely to possess the relevant information. Id. Plaintiff took the Court up on its invitation and filed the instant Motion [#46]. II. Applicable Law Generally, formal discovery is not permitted until the parties have conferred under Fed. R. Civ. P. 26(f). See FED. R. CIV. P. 26(d)(1) (“A party may not seek discovery from any source before the parties have conferred as required by Rule 26(f), except in a proceeding exempted from initial disclosure under Rule 26(a)(1)(B), or when authorized by these rules, by stipulation, or by court order.”). However, a court may exercise discretion to “alter the timing, sequence, and volume of discovery.” See Qwest Commc’ns

Int’l, Inc. v. WorldQuest Networks, Inc.,

(D. Colo. 2003). In this District, courts have permitted expedited discovery upon a showing of good cause. See, e.g., SEBO Am., LLC v. Does, No. 21-cv-02865-RM-STV,

, at *1 (D. Colo. Oct. 29, 2021) (citing Pod-Ners v. N. Feed & Bean of Lucerne Ltd.,

(D. Colo. 2002)); Liberty Media Holdings, LLC v. Colo. Members of Swarm, No. 11-cv-01170-WJM-KMT,

, at *1 (D. Colo. May 12, 2011) (citing same). “Good cause may exist where the plaintiff seeks a preliminary injunction, where the moving party has asserted claims of infringement or unfair competition, or ‘where physical evidence may be consumed or destroyed with the passage of time, thereby disadvantaging one or more parties to the litigation.’” SEBO Am., LLC,

, at *1 (quoting Qwest Commc’ns,

). However, “[i]n applying the ‘good cause’ standard under Rule 26(d), the court should consider the scope of the requested discovery.” Qwest Commc’ns,

.

A plaintiff’s inability to identify a defendant is “one of the few reasons that early discovery is generally permitted.” Malibu Media, LLC v. John Doe Subscriber Assigned IP Address 174.51.234.104, No. 13-cv-00307-WYD-MEH,

, at *4 (D. Colo. July 14, 2013) (citing 20/20 Fin. Consulting, Inc. v. Does 1-5, No. 10-cv-01006- CMA-KMT,

, at *1 (D. Colo. May 11, 2010)). In those situations, “the plaintiff should be given an opportunity through discovery to identify the unknown defendants, unless it is clear that discovery would not uncover the identities, or that the complaint would be dismissed on other grounds.” 20/20 Fin. Consulting,

, at *1.

III. Analysis The Court previously determined that Plaintiff’s inability to identify the defendants presents good cause to engage in early discovery. See Order [#45] at 5. However, the Court noted certain issues regarding the scope of Plaintiff’s requested relief. First, the Court recognized that Plaintiff’s request to subpoena thirteen third parties was excessive and repetitive, and that he ultimately failed to explain why any of those third parties would possess the relevant identifying information. Id. at 6. Second, the Court explained that the information Plaintiff sought far exceeded the information necessary to uncover the defendants’ identities. Id. at 6-7. In the Motion [#46], Plaintiff narrows the number of third parties he wishes to serve. Plaintiff identifies three third parties in his Motion [#46]: Coinbase, Inc. (“Coinbase”), Foris DAX, Inc. (“Foris”),1 and BAM Trading Services Inc. (Binance.US) (“Binance”). Motion [#46] at 2-4. This is consistent with the Court’s prior Order [#45] directing Plaintiff to

identify no more than three third parties. Id. at 7, 14. In addition, the Court ordered Plaintiff to explain why each third party is likely to possess the information he needs. Id. Plaintiff asserts that Coinbase is likely to possess the relevant information because the stolen bitcoin originated from Plaintiff’s Coinbase account. Id. at 3. As a result, Coinbase is likely to possess information regarding where the funds were sent and what account received them. Id. Plaintiff next asserts that Foris is the “technical gateway through which the fraud was executed.” Id. He claims that Foris will possess information such as IP address logs and session identifiers, among other things, which document how the defendants interacted with Plaintiff’s device and wallet. Id. Finally, Plaintiff wishes to serve Binance. Id. at 4. Plaintiff argues that blockchain tracing demonstrates that the stolen funds

ultimately reached a custodial address controlled by Binance, which requires users to provide identification information. Id. As a result, Binance “provides the real-world identity” of the recipient of the stolen funds and is the entity “most likely to possess the information needed to identify” the defendants. Id. The Court finds that Plaintiff has adequately explained why these three third parties are likely to possess relevant identifying information. Next, the Court required Plaintiff to narrowly tailor his request to only information needed to identify the defendants. Order [#45] at 7, 14. The Court previously noted that

1 Plaintiff contends that Foris is the designated U.S. legal process recipient for Onchain Wallet Limited, which is incorporated offshore. Motion [#46] at 3-4. Plaintiff’s requested information was far too broad, and much of that information could be obtained through the ordinary course of discovery. Id. at 7. In his Motion [#46], Plaintiff first requests the subscriber or account holder information, including names, mailing addresses, email addresses, phone numbers, date of account creation, and “any KYC-

verification identifiers such as the type of government ID provided[.]” Motion [#46] at 5. However, Plaintiff goes on to request information that, once more, appears unnecessary at this stage. For instance, he requests information such as device fingerprints, timestamped session logs, and “authentication records showing when and how the account was accessed[.]” Id. Moreover, he requests deposit logs, internal ledger entries, and certain metadata, which he believes is necessary to uncover the defendants’ identities. Id. Once again, the Court finds that Plaintiff’s requested information is too broad and exceeds the scope of information necessary for the sole purpose of identifying the defendants. See Qwest,

(denying expedited discovery request as overly broad).

The Court understands that Plaintiff is demonstrating best efforts to comply with the Court’s prior Order [#45]. To prevent further delay of his case, the Court will allow Plaintiff to serve the nonparty subpoenas on Coinbase, Binance, and Foris, but will limit the information he is permitted to request to include only the defendants’ names, current and permanent addresses, billing addresses, telephone numbers, email addresses, and IP addresses. This information is consistent with what other courts in this District have permitted under similar circumstances. See, e.g., Trainor v. Doe, No. 22-cv-00350- RM-NYW,

, at *3 (D. Colo. Feb. 14, 2022). The Eastern District of Wisconsin took a similar approach in Wuluvarana v. Does, No. 22-cv-982-pp,

, at *4 (E.D. Wis. Jan. 13, 2023). Wuluvarana involved an identical cryptocurrency theft scenario where the defendants’ identities were unknown. Id. at *1. The plaintiff sought to serve early discovery on certain third parties, including

Binance and Coinbase. Id. at *1-2. Along with requesting certain identifying information, the plaintiff also requested each third party’s internal documents regarding the at-issue accounts, among other things. Id. at *4. While the court found good cause for expedited discovery, it noted the scope of the requested discovery was unnecessary. Id. Ultimately, the court limited the information sought to the “name, street address, telephone number and e-mail address of each John Doe.” Id. at *5. Therefore, the Court finds it appropriate to limit Plaintiff’s requested discovery, as explained above. Finally, Plaintiff again requests the Court enter a nondisclosure order prohibiting the subpoenaed third parties from disclosing the existence of Plaintiff’s forthcoming subpoenas. Motion [#46] at 6. For the reasons explained in the Court’s prior Order [#45],

and to allow the defendants to avail themselves of the protections afforded by Federal Rule of Civil Procedure 45(d)(2)(B), the Court will not allow this. See Order [#45] at 11- 12. IV. Conclusion For the reasons expressed above,

IT IS HEREBY ORDERED that the Motion [#46] is GRANTED in part and DENIED in part. The court GRANTS the Motion [#46] to the extent that the Court will allow Plaintiff to issue subpoenas under Fed. R. Civ. P. 45 to Coinbase, Binance and Foris for the sole purpose of obtaining information to identify the unknown defendants. This information consists of only the names, current and permanent addresses, billing addresses, telephone numbers, email addresses, and IP addresses associated with each unknown defendant. A copy of this Order must be attached to each subpoena. The court DENIES the Motion [#46] to the extent that it asks for information beyond what the

Court has identified above and to the extent it requests Coinbase, Binance, and Foris not disclose the subpoenas to the defendants. IT IS FURTHER ORDERED that Plaintiff may serve his third-party subpoenas on Coinbase, Binance, and Foris no later than December 31, 2025. IT IS FURTHER ORDERED that Coinbase, Binance and Foris must provide a copy of the subpoena to each defendant and any other affected user as soon as possible after service of the subpoena. Coinbase, Binance and Foris and any affected user must have 14 days from the date of service of the subpoena to object to the subpoena under Federal Rule of Civil Procedure 45(d)(2)(B). Coinbase, Binance and Foris must not disclose any defendants’ identifying information, or such information for

any other affected user, during that 14-day period (or if a timely objection is served, unless and until the court so orders). If an objection is served, Coinbase, Binance and Foris must preserve any material responsive to the subpoena for a period of no less than 90 days to allow Plaintiff to file a motion to compel, if he so desires. IT IS FURTHER ORDERED that Plaintiff may only use the information disclosed in response to the subpoenas for the purpose of enforcing his rights as asserted in his First Amended Complaint [#36]. Improper use of the information obtained in response to the subpoenas may result in sanctions.

Dated: November 25, 2025 BY THE COURT: Kathryn A. Starnella United States Magistrate Judge