Legacy Investments Holdings, LLC v. John Does 1-20

Background

Legacy Investments Holdings, LLC applied without advance notice for a temporary restraining order against unidentified defendants. Legacy alleged that the defendants participated in a scheme that stole approximately $28 million in cryptocurrency assets from Legacy’s affiliate, Legacy Worldwide Investments II, Ltd. According to Legacy, a fraudulent airdrop placed malicious code on a trader’s computer, allowing the defendants to access Worldwide’s cryptocurrency wallet and transfer the assets to their own account.

Legacy’s expert, Julia Gottesman, testified that she traced the assets to active lending contracts controlled by the defendants and that the assets continued to be transferred through complex, anonymous transactions. Legacy also sought early discovery to identify the defendants and trace additional assets, as well as permission to serve court papers through nonfungible tokens sent to the defendants’ cryptocurrency wallet addresses.

Temporary Restraining Order

The court applied the standard used for a preliminary injunction. Legacy had to show a likelihood of success on the merits, a likelihood of irreparable harm without an order, that the balance of hardships favored relief, and that the injunction served the public interest. The court found that Legacy met those requirements.

The court concluded that Legacy was likely to succeed on its conversion claim. Under California law, conversion involves wrongful control over another person’s property. The court found that Legacy was authorized to act for Worldwide, had alleged that the defendants took more than $28 million in digital assets without authorization, and had supplied testimony tracing the assets to the alleged theft. The court did not decide Legacy’s likelihood of success on its other claims.

The court also found a significant risk that the assets would disappear through further transfers, forced liquidation, or cryptocurrency-market volatility. It determined that a limited, short-term freeze was unlikely to seriously harm the defendants and that stopping, investigating, and remedying fraud served the public interest.

The court held that it had authority to freeze the assets before judgment because Legacy sought equitable relief, including a constructive trust. A constructive trust is a court-ordered arrangement concerning property wrongfully acquired or held by someone else. The court found that the existing evidence indicated Legacy was likely to support that request. It further found that advance notice was not required because the assets were likely to be dissipated before the defendants could respond. Because the defendants’ identities were unknown and there was no evidence of damages they might suffer, the court did not require Legacy to post a bond.

Early Discovery

The court found good cause to allow discovery before the parties’ usual discovery conference. Legacy had investigated for several years without identifying the alleged thieves or tracing all the assets, and the court had already found a likelihood of success on the conversion claim. Legacy proposed targeted subpoenas to cryptocurrency exchanges and blockchain service providers that might have information about the defendants and the assets.

The court granted Legacy leave to serve those subpoenas. The discovery was limited to identifying the individuals or entities allegedly responsible for the theft and tracing the assets. Each subpoena recipient had 30 days after service to object or seek to quash or modify the subpoena. The order preserved any objections the recipients might later make.

Alternative Service

The court authorized service through nonfungible tokens because Legacy did not know the defendants’ names, identities, or addresses but knew the addresses of cryptocurrency wallets that could receive the tokens. The court found that the proposed method was reasonably calculated to provide notice because the wallets had recently been active and their activity was traceable to the defendants according to Gottesman’s testimony.

The token had to display an image containing the summons, include notice of the lawsuit and a link to copies of the order, temporary restraining order, complaint, motion, and related filings, and explain that it transmitted official court documents. Service would be effective when the token was successfully transferred to the identified wallet addresses, but the defendants could later challenge whether they received adequate notice.

Disposition

The court granted the motion. A separate temporary restraining order was to issue. The order was dated October 23, 2025, and signed by United States District Judge Rita F. Lin.