BELLIS v. KELLY (2025)

MEMORANDUM ORDER

THIS MATTER comes before the Court by way of a Motion for a Temporary Restraining Order, filed ex parte, by John Bellis (“Plaintiff”). (ECF No. 2). This Court has jurisdiction under 28 U.S.C. § 1331 because this case involves a federal question under the Computer Fraud and Abuse Act (“CFFA”), 18 U.S.C. § 1030 et seq. Plaintiff seeks a Temporary Restraining Order to prevent A.R., a minor, by and through his parent and natural guardian Dulaney Kelly; Dulaney Kelly individually; and certain unknown individuals (collectively, “Defendants”) from further transferring or concealing Plaintiff's stolen cryptocurrency, and to prevent Payword, Inc. (d/b/a Kraken); XT.com; HTX.com; Cobo.com; Coinbase, Inc.; and other unknown custodians (collectively, “Relief Defendants”) from dissipating or disposing of those assets pending further proceedings. Pursuant to Local Rule 78.1 the Court did not hear oral argument. For the reasons that follow, Plaintiff's Motion is GRANTED.

I. BACKGROUND

Plaintiff is a hedge fund trader who resides in Montgomery County, Pennsylvania, and owns a family home in Avalon, New Jersey. (Bellis Decl., ECF No. 2-2 at ¶ 1). On July 28, 2025, Plaintiff alleges that his stepson, A.R., with the aid of his biological father, Dulaney Kelly, accessed Plaintiff's personal devices and stole $430,000 worth of cryptocurrency—specifically, 3.506 Bitcoins and 65.027 Solana Coins (the “Stolen Assets”)—from Plaintiff's Gemini account. (Compl., ECF No. 1 at ¶¶ 1, 6, 8; Bellis Decl., ECF No. 2-2 at ¶ 4).

A.R. allegedly used confidential information, including Plaintiff's iPhone PIN and digital asset credentials (“Confidential Information”), which he obtained by surreptitiously accessing a document on Plaintiff's desktop labeled “JABIII – If I Die” during a June 2025 visit to the Avalon home. (Compl., ECF No. 1 at ¶¶ 49–51; Bellis Decl., ECF No. 2-2 at ¶¶ 9–10). With this information, A.R. disabled Gemini's “Wallet Whitelisting” security feature, thereby removing the mandatory seven-day hold on adding new crypto wallets. (Compl., ECF No. 1 at ¶¶ 52–53; Bellis Decl., ECF No. 2-2 at ¶ 12). According to Plaintiff's forensic experts, these actions were executed locally from Plaintiff's own devices. (Bellis Decl., ECF No. 2-2 at ¶ 17; Ex. A, ECF No. 2-2 at 10–11; Ex. C, ECF No. 2-2 at 43).

In late July 2025, A.R. returned to Avalon for a family visit. (Compl., ECF No. 1 at ¶¶ 56–57; Bellis Decl., ECF No. 2-2 at ¶ 13). During the early morning hours of July 28, A.R. allegedly used the stolen PIN to access Plaintiff's iPhone, added his own cryptocurrency wallets to the Gemini account, and transferred the Stolen Assets to himself. (Compl., ECF No. 1 at ¶ 60; Bellis Decl., ECF No. 2-2 at ¶ 14). A forensic investigation confirmed that at 4:53 a.m. that day, a fake “hacker note” was typed on Plaintiff's desktop computer, which A.R. allegedly used in an effort to obscure his involvement. (Compl., ECF No. 1 at ¶¶ 62, 78; Bellis Decl., ECF No. 2-2 at ¶¶ 15–16; Ex. C, ECF No. 2-2 at 43).

Blockchain analysis has since traced the stolen BTC and SOL across multiple wallets and cryptocurrency exchanges. (Ex. B, ECF No. 2-2 at 13–32; see also Compl., ECF No 1 at ¶¶ 67–76; Bellis Decl., ECF No. 2-2 at ¶¶ 5, 29–30, 35). Specifically, forensic investigators determined that A.R. employed common laundering tactics such as peel chaining, funnel wallets, and co-mingling, ultimately transferring Plaintiff's assets to at least five Virtual Asset Service Providers (“VASPs”), including Kraken, HTX, XT.com, Cobo.com, and Coinbase. (Compl., ECF No 1 at ¶¶ 74–76, 87–88; Ex. B, ECF No. 2-2 at 16–20). As of August 21, 2025, a total of 3.267 BTC and 62.647 SOL had been deposited with these exchanges. (Compl., ECF No 1 at ¶ 76; Ex. B, ECF No. 2-2 at 20).

Plaintiff alleges that Kelly not only failed to prevent A.R.’s misconduct but also enabled and concealed it by allowing A.R. continued access to electronic devices despite a court order restricting his internet usage in a separate Ohio cybercrime prosecution. (Compl., ECF No. 1 at ¶¶ 13, 43–47, 80–82, 85–86, 89–90; Bellis Decl., ECF No. 2-2 at ¶¶ 6–8, 22–24, 27–28, 31–32).

On August 26, 2025, Plaintiff filed his Complaint, (ECF No. 1), and Motion for a Temporary Restraining Order. (ECF No. 2). Plaintiff asserts claims under the CFAA, 18 U.S.C. § 1030 et seq. (“Count I”); the New Jersey Computer-Related Offenses Act, N.J.S.A. § 2A:38A (“Count II”); Fraud (“Count III”); Conversion (“Count IV”); Replevin, N.J.S.A § 2B:50-1 (“Count V”); Unjust Enrichment (“Count VI”); Misappropriation of Confidential Information (“Count VII”); Civil Conspiracy (“Count VIII”); and Negligence (“Count IX”). (Compl., ECF No. 1 at ¶¶ 94–176). Plaintiff also seeks equitable relief (“Count X”), including an order imposing a constructive trust, enjoining Defendants from transferring or dissipating the Stolen Assets, requiring a sworn accounting of wallets and transactions involving the Stolen Assets, and directing A.R. to return and cease all use of Plaintiff's Confidential Information. (Compl., ECF No. 1 at ¶¶ 177–185; Proposed Order, ECF No. 2-3).

II. LEGAL STANDARD

Federal Rule of Civil Procedure 65 governs the issuance of temporary restraining orders and preliminary injunctions. Fed. R. Civ. P. 65; Vuitton v. White, 945 F.2d 569, 573 (3d Cir. 1991). Preliminary injunctive relief is “an extraordinary remedy” and “should be granted only in limited circumstances.” AT&T v. Winback & Conserve Program, Inc., 42 F.3d 1421, 1426–1427 (3d Cir. 1994) (quoting Frank's GMC Truck Center, Inc. v. Gen. Motors Corp., 847 F.2d 100, 102 (3d Cir. 1988)). To obtain relief, the moving party must show: (1) a likelihood of success on the merits; (2) they will suffer irreparable harm if the injunction is denied; (3) granting relief will not result in even greater harm to the nonmoving party; and (4) the public interest favors such relief. Child Evangelism Fellowship of N.J. Inc. v. Stafford Twp. Sch. Dist., 386 F.3d 514, 524 (3d Cir. 2004) (citation omitted).

While courts must balance all four factors, Kershner v. Mazurkiewicz, 670 F.2d 440, 443 (3d Cir. 1982), this Circuit has placed significant weight “on the probability of irreparable harm and the likelihood of success on the merits” factors. FM 103.1, Inc. v. Universal Broad., 929 F. Supp. 187, 193 (D.N.J. 1996) (quoting Hoxworth v. Blinder, Robinson & Co., 903 F.2d 186, 197 (3d Cir. 1990)). A court should only issue an injunction “if the plaintiff produces evidence sufficient to convince the district court that all four factors favor preliminary relief.” AT&T, 42 F.3d at 1427.

III. DISCUSSION

A. Likelihood of Success on Merits

As a general rule, courts may not freeze a defendant's assets as part of a temporary restraining order or preliminary injunction in an action seeking only money damages. Grupo Mexicano de Desarrollo S.A. v. Alliance Bond Fund, Inc., 527 U.S. 308, 333 (1999). However, Plaintiff seeks the equitable remedy of a constructive trust over specific, traceable digital assets allegedly stolen by his stepson and currently held in identifiable cryptocurrency wallets. (Pl.’s Mot., ECF No. 2-1 at 12–13). “There is an exception to the general ban on prejudgment asset restraints where an equitable remedy is sought.” Nail Alliance, LLC v. TTN Beauty, No. 21-3140, 2021 WL 2646989, at *2 (D.N.J. Mar. 10, 2021). Accordingly, the Court focuses on Plaintiff's claims for conversion, unjust enrichment, and constructive trust, each of which may support the equitable relief requested. See Mirashi v. Doe, No. 25-1805, 2025 WL 783353, at *3 (D.N.J. Mar. 12, 2025); see also Astrove v. Doe, No. 22-80614, 2022 WL 2805315, at *3 (S.D. Fla. Apr. 22, 2022) (freezing cryptocurrency assets via TRO where plaintiff brought claims for conversion, unjust enrichment, and sought constructive trust). Plaintiff need not demonstrate a likelihood of success on all ten causes of action plead; it is enough to show a likelihood of success on any one of them. See Miller v. Mitchell, 598 F.3d 139, 148 (3d Cir. 2010) (affirming preliminary injunction where plaintiff demonstrated likelihood of success on two of three claims).

Under New Jersey law, the elements of conversion are: (1) that the property and the right to its immediate possession belong to the plaintiff; and (2) the wrongful act of interference with that right by the defendant. Latef v. Cicenia, No. A5747-13T2, 2016 WL 10458543, at *5 (N.J. Super. Ct. App. Div. Mar. 14, 2016) (citation omitted). Similarly, the elements of unjust enrichment are: (1) the defendant received a benefit; (2) retention of that benefit without payment would be unjust; (3) the plaintiff expected remuneration; and (4) failure to remit payment unjustly enriched the defendant. EnviroFinance Grp., LLC v. Env't Barrier Co., 113 A.3d 775, 790 (N.J. Super. Ct. App. Div. 2015) (citation omitted). Moreover, a constructive trust may be imposed when a wrongful act causes property to come into the recipient's hands and the recipient would be unjustly enriched if allowed to retain it. Thompson v. City of Atlantic City, 901 A.2d 428, 438 (N.J. Super. Ct. App. Div. 2006) (citation omitted).

Here, Plaintiff plausibly alleges that he owned the cryptocurrency stored in his Gemini wallet and that A.R. wrongfully transferred the assets to himself using credentials and security information obtained without authorization. (Compl., ECF No. 1 at ¶¶ 6, 49–60; Bellis Decl., ECF No. 2-2 at ¶¶ 9–14). Blockchain tracing confirms that the stolen digital assets were subsequently deposited into accounts traceable to A.R. at various exchanges. (Compl., ECF No. 1 at ¶¶ 60–61, 73–76; Bellis Decl., ECF No. 2-2 at ¶¶ 14, 29–30, 35; Ex. B, ECF No. 2-2 at 16–20). At this stage, these allegations, supported by forensic tracing in the current record, demonstrate a likelihood of success on the merits of Plaintiff's claims for conversion, unjust enrichment, and a constructive trust and support the requested injunctive relief requiring Defendants to freeze the Stolen Assets and A.R. to return and cease all use of Plaintiff's Confidential Information.

B. Irreparable Harm

Courts have recognized that in cases involving theft of cryptocurrency, the threat of dissipation and concealment gives rise to immediate and irreparable harm. Mirashi, 2025 WL 783353, at *4 (collecting cases); see also Licht v. Ling, No. 23-1018, 2023 WL 4504585, at *3 (N.D. Tex. June 20, 2023) (“The Court finds that freezing the alleged fraudsters’ wallets is the proper relief and is the only feasible way to prevent irreparable harm to Licht at this stage.”); Jacobo v. Doe, No. 22-00672, 2022 WL 2052637, at *3 (E.D. Cal. June 7, 2022) (citation omitted) (“[T]he fact that the assets at issue here are held in cryptocurrency weighs in favor of the granting of injunctive relief and a freezing of the assets because there is a high risk of asset dissipation with cryptocurrency.”). The Third Circuit has likewise held that irreparable harm exists where, absent an asset freeze, defendants are likely to dissipate or fraudulently convey the very assets necessary to satisfy a judgment. Elliott v. Kiesewetter, 98 F.3d 47, 58 (3d Cir. 1996) (affirming freeze order to prevent “consumption, dissipation or fraudulent conveyance” of assets subject to potential recovery).

Plaintiff's Complaint and supporting materials demonstrate that Defendants have already begun to dissipate the Stolen Assets through dozens of transfers across multiple wallets and exchanges—including XT.com, HTX.com, Kraken, Cobo.com, and Coinbase—in patterns consistent with peel chaining and comingling. (Ex. B, ECF No. 2-2 at 13–32; see also Compl., ECF No 1 at ¶¶ 67–76, 87–88; Bellis Decl., ECF No. 2-2 at ¶¶ 5, 29–30, 35). If those assets are further laundered or withdrawn, they will be permanently lost, and Plaintiff will have no adequate remedy at law.

Plaintiff also faces irreparable harm from Defendant A.R.’s continued possession of his highly sensitive personal financial information. The Complaint alleges, and forensic evidence confirms, that A.R. accessed a private file labeled “JABIII – If I Die,” containing Plaintiff's iPhone PIN, bank account numbers, investment account credentials, and private keys to cryptocurrency wallets. (Compl., ECF No. 1 at ¶¶ 49–51; Bellis Decl., ECF No. 2-2 at ¶¶ 9–10). Courts have held that a plaintiff may suffer irreparable harm if such confidential information is not promptly returned. See Legend Biotech USA Inc. v. Liu, No. 23-02965, 2024 WL 919082, at *9 (D.N.J. Mar. 4, 2024) (collecting cases). As the court explained in Legend Biotech, “if Plaintiff can demonstrate it is probable Defendant is still in possession of its confidential and proprietary information, it will be able to show a probability of irreparable harm.” Id. That standard is satisfied here. Despite Plaintiff's request, A.R. has not returned or certified deletion of the confidential materials, and his continued access poses an ongoing risk of further theft or harm. Plaintiff therefore faces irreparable harm not only from the threatened loss of specific digital assets, but also from the ongoing misuse or exposure of sensitive financial information. Accordingly, Plaintiff has established a compelling showing of irreparable harm sufficient to support temporary injunctive relief.

C. Harm to Others and Public Interest

As alleged, the assets at issue rightfully belong to Plaintiff and nobody else. According to the Complaint and attached Exhibits, Plaintiff's Bitcoin and Solana Coin were stolen from his cryptocurrency wallets and are now being distributed through a complex, multi-phase obfuscation strategy designed to conceal the source and true ownership of the stolen funds. (Compl., ECF No. 1 at ¶¶ 6, 49–61, 73–76; Bellis Decl., ECF No. 2-2 at ¶¶ 9–14, 29–30, 35; Ex. B, ECF No. 2-2 at 16–20). Therefore, there is no apparent harm to others or to the public interest that would result if the TRO is granted. The requested relief would merely preserve the status quo and prevent Defendants and downstream recipients from further dissipating or concealing assets to which they have no lawful claim. Song v. Doe, No. 24-809, 2024 WL 4632242, at *3 (M.D. Fla. Aug. 19, 2024), amended sub nom. Song v. Def. 1, 2024 WL 4606067 (M.D. Fla. Oct. 29, 2024) (“The threatened injury here, Plaintiff's loss of over $200,000 worth of cryptocurrency, outweighs any possible harm of freezing the cryptocurrency wallets Destination Addresses since the wallets contain Plaintiff's stolen assets due to the alleged unlawful activity of Defendants.”). To the contrary, granting injunctive relief here would promote the public interest by deterring digital asset theft, aiding law enforcement investigations, and supporting the integrity of the financial system, including compliance with anti-money laundering obligations. Licht, 2023 WL 4504585, at *3 (finding that “an injunction would serve the public interest because it will dissuade would-be fraudsters from stealing, laundering illegal proceeds, and preying on Americans.”); Gaponyuk v. Alferov, No. 23-01317, 2023 WL 4670043, at *3 (E.D. Cal. July 20, 2023) (finding that “a temporary asset freeze will serve the public's interest in stopping, investigating and remedying frauds.”); Yogaratnam v. Dubois, No. 24-393, 2024 WL 758387, at *4 (E.D. La. Feb. 23, 2024) (TRO in cryptocurrency case promotes objectives of Treasury Department and provides assurance that courts will protect and aid investors in their recovery of stolen assets); Song, 2024 WL 4632242, at *3 (TRO in cryptocurrency fraud case furthers public interest by promoting objectives of Financial Crimes Enforcement Network).

D. Notice is Not Required

Plaintiff's counsel has certified that he has not provided notice to Defendants A.R. or Dulaney Kelly because doing so would risk further irreparable harm. (Papianou Decl., ECF No. 2-2 at 50). Specifically, counsel explains that alerting Defendants that Plaintiff is seeking an asset freeze would likely prompt them to take more extreme measures to further “conceal and dissipate the stolen Bitcoin and Solana Coin,” including the use of laundering tactics and offshore exchanges. (Id.). The Court agrees and finds that notice is not required here under Rule 65(b)(1). See Fed. R. Civ. P. 65(b)(1)(A) (permitting courts to enter a temporary restraining order without notice to the adverse parties if “specific facts in an affidavit or a verified complaint clearly show that immediate and irreparable injury, loss, or damage will result to the movant before the adverse party can be heard in opposition.”); see also Gaponyuk, 2023 WL 4670043, at *2 (“It is appropriate in these circumstances to consider [plaintiff]’s application without first giving notice to the defendants,” specifically because of the risk of cryptocurrency being rapidly moved and becoming untraceable); Jacobo, 2022 WL 2052637, at *3 (citation omitted) (“If defendant were provided notice of this action, ‘it would be a simple matter for [him] to transfer [the Tether] to unidentified recipients outside the traditional banking system, including contacts in foreign countries, and effectively put it beyond the reach of this [c]ourt.’ ”).

E. The Court Will Assess a Nominal Bond

Rule 65(c) requires that a movant seeking a temporary restraining order post “security in an amount that the court considers proper to pay the costs and damages sustained by any party found to have been wrongfully enjoined or restrained.” Fed. R. Civ. P. 65(c). However, district courts have discretion to require no bond or to require only a nominal bond depending on the circumstances of the case. Bascom Food Prods. Corp. v. Reese Finer Foods, Inc., 715 F. Supp. 616, 641 n.31 (D.N.J. 1989).

Here, Plaintiff seeks to freeze specific, traceable cryptocurrency assets that were allegedly stolen from his digital wallets. The Relief Defendants are cryptocurrency exchanges that hold some portion of the Stolen Assets, and Plaintiff does not seek to enjoin their general operations or accounts unrelated to the theft. Given the limited scope of the injunction, the narrow tailoring of the relief, and the strength of the underlying claims, the risk of wrongful restraint and resulting harm is minimal. Accordingly, the Court will assess a nominal bond in the amount of $1,000. Song, 2024 WL 4632242, at *4 (determining $1,000 bond was adequate in cryptocurrency fraud case to pay the costs and damages, if any, sustained by any party found to have been wrongfully enjoined).

* * * * *

For the foregoing reasons,

IT IS HEREBY on this 28th day of August, 2025,

ORDERED that Plaintiff's Motion, (ECF No. 2), is GRANTED. Defendants, Relief Defendants, and all persons acting in concert or participation with them, are hereby restrained and enjoined from directly or indirectly transferring, selling, assigning, dissipating, concealing, or otherwise disposing of any cryptocurrency, fiat currency, or other assets in their possession, custody, or control that are traceable to the Stolen Assets; and it is further

ORDERED that within five (5) days of service of this Order, A.R., and anyone acting in concert with him, shall provide Plaintiff's counsel and the Court with a sworn accounting identifying: (a) all wallets, accounts, or custodial platforms in which he holds cryptocurrency or digital assets; and (b) all transactions or transfers involving the Stolen Assets or their proceeds; and it is further

ORDERED that Defendant A.R., and anyone acting in concert with him, shall, within 48 hours of service of this Order: (a) return to Plaintiff all of Plaintiff's Confidential Information in his possession, custody, or control, including but not limited to account credentials, security keys, seed phrases, authentication codes, social security numbers, financial and bank account information, and any copies thereof; (b) cease any use of Plaintiff's Confidential Information for any purpose; and (c) file with the Court and serve upon Plaintiff's counsel a sworn affidavit of compliance attesting to the full return and cessation of use of Plaintiff's Confidential Information; and it is further

ORDERED that the bond requirement under Federal Rule of Civil Procedure 65(c) is set at $1,000; and it is finally

ORDERED that this Temporary Restraining Order shall remain in effect for fourteen days from the date of this Order, unless otherwise extended by the Court. The Preliminary Injunction hearing will take place on September 9, 2025 at 9:00am before the undersigned in Courtroom 5A, United States Courthouse, 4th and Cooper Streets, Camden, New Jersey. The briefing schedule is as follows: Defendants shall file and serve any papers in advance of the Preliminary Injunction Hearing by September 4, 2025. Plaintiff shall file and serve any reply papers in advance of the Preliminary Injunction Hearing by September 5, 2025; and it is further

ORDERED that prior to the Preliminary Injunction Hearing, Defendants may move to vacate or modify the Temporary Restraining Order on two days’ notice to Plaintiff; and it is finally

ORDERED that Plaintiff shall immediately effectuate service upon all Defendants within two (2) days of the date of this Order via electronic mail and personal service, and promptly file proof of service with the Court.

O'HEARN, District Judge.