Yes. In the United States, a properly issued subpoena to a centralized crypto exchange will usually produce account and KYC records when the request is narrowly scoped and served on the correct entity. A subpoena identifies the person behind an account, but it does not freeze or seize funds by itself. Anyone pursuing stolen crypto should preserve blockchain evidence immediately, confirm which entity and jurisdiction hold the records, and consult counsel before drafting the request.
TL;DR:
- Precise on-chain identifiers like deposit addresses and timestamps are crucial for targeting the correct accounts in subpoenas.
- U.S.-based exchanges process well-scoped subpoenas quickly, whereas offshore platforms often require lengthy foreign legal procedures.
- Courts favor narrowly tailored requests and penalize vague or broad subpoenas, making specificity essential for enforcement.
- Privacy coins and mixers complicate recovery efforts, often shifting focus to on-ramp and off-ramp exchanges with KYC data.
- Early preservation, targeted subpoenas, and law enforcement coordination are key to preventing fund displacement before legal action.
Table of Contents
- What records crypto exchanges typically hold and can produce
- How to draft and serve an effective subpoena to a crypto exchange
- How exchanges typically respond and where offshore delays creep in
- Legal limits and defenses: Rule 45, the SCA, and Fourth Amendment caselaw
- First 30 to 90 days: what to do after finding a deposit address
- How Murphy’s Law approaches subpoenas in active fraud cases
- Handling subpoenas involving privacy coins or mixer services
- Data privacy and compliance obligations exchanges face when responding
- Considerations for subpoenas targeting decentralized exchanges
- Why subpoenas remain central despite regulatory uncertainty
- How Legal counsel can help with subpoena-driven recovery
- Sources
- FAQ
What records crypto exchanges typically hold and can produce
Centralized exchanges such as Coinbase, Binance, Kraken, Gemini, Cash App, and Crypto.com collect and retain far more data than most account holders realize, largely because of federal anti-money-laundering obligations. That data trail is what makes a well-drafted subpoena so useful in fraud and recovery matters. Exchanges typically maintain:
- Account opening and KYC records, including government-issued ID, full legal name, and residential address, which tie a wallet to a real person.
- Transaction histories, including blockchain transaction hashes, timestamps, and deposit or withdrawal amounts, which map on-chain activity to a specific account.
- Banking and funding source details, such as linked debit cards, ACH transfers, and wire origination data, which can trace where fiat entered or exited the platform.
- IP address logs, multi-factor authentication records, and login timestamps, which help establish who actually controlled the account at the time of a transfer.
- Customer support tickets and correspondence, which sometimes contain admissions, complaints, or account recovery attempts relevant to a fraud timeline.
Not every record is treated the same way under federal law. Basic subscriber and transactional records are generally considered non-content account information, while stored communications, like the actual text of support messages, can receive stronger protection depending on how the request is framed. Practitioner resources on what exchanges can produce for investigators note that KYC and AML files are often the fastest path to identifying a scammer once a deposit address is known.
A 2024 federal court order allowed Rule 45 subpoenas limited strictly to legal name, street address, telephone number, and email for accounts tied to specific destination addresses, while denying broader discovery requests. That order illustrates how courts reward precision and punish overreach, a theme that runs through nearly every successful exchange subpoena.
How to draft and serve an effective subpoena to a crypto exchange
A subpoena that survives objections starts with specificity. Courts and exchange compliance teams both respond faster to requests that read like a forensic report rather than a fishing expedition. A workable draft generally follows this sequence:
- Identify exact on-chain identifiers, including deposit or withdrawal addresses, transaction hashes, and UTC timestamps for every transfer at issue.
- List known account identifiers, such as email addresses, usernames, or account numbers, if any have already surfaced through prior correspondence or forensic tracing.
- Enumerate discrete categories of records requested, separating KYC data, transaction logs, banking links, and IP data into distinct, narrow paragraphs instead of one sweeping demand.
- Specify a production format, requesting native electronic files or CSV exports that preserve transaction hashes and metadata rather than screenshots or PDFs.
- Confirm the correct entity and service method, since many exchanges route subpoenas through a law-enforcement portal for criminal matters or a registered agent for civil service, and serving the wrong entity causes weeks of delay.
- Respect Rule 45’s geographic and burden limits, issuing from the court where compliance is required and using UIDDA domestication when the exchange’s records custodian sits in another state.
Civil litigants generally cannot issue a Rule 45 subpoena until a case is filed, though courts sometimes allow expedited discovery before the Rule 26(f) conference when funds are actively moving. Federal Rule of Civil Procedure 45 requires the issuing party to take reasonable steps to avoid undue burden, and it gives the recipient grounds to object or move to quash when a request is too broad, too distant, or too vague. Criminal investigations follow a different track: law enforcement can request delayed notice provisions that bar the exchange from alerting the account holder, which matters when tipping off a suspect could trigger fund movement or evidence destruction.
Pro Tip: Draft every subpoena as if a magistrate judge will read it looking for a reason to narrow it, because that is exactly what happens when the request is vague. For service mechanics and the exact identifiers exchanges expect to see, see how to serve a U.S. crypto exchange with hashes and timestamps.
How exchanges typically respond and where offshore delays creep in
Response timing varies widely depending on whether the exchange is a domestic, regulated entity or an offshore platform with no meaningful U.S. presence. A typical civil subpoena to a major U.S.-facing exchange moves through predictable stages: acknowledgment of service, an internal legal review, sometimes a meet-and-confer to narrow scope, and then production. That sequence can move quickly when the request is precise and slowly when it is not.
- Domestic or U.S.-regulated exchanges, including those with U.S. subsidiaries or compliance agents registered here, generally process well-scoped civil subpoenas without needing international process, since their records custodians are subject to Rule 45 directly.
- Offshore or globally distributed platforms may require foreign legal process, and when the matter is criminal, a Mutual Legal Assistance Treaty request is often the only avenue, a process that typically takes six to eighteen months and is generally unavailable to private civil litigants.
- Wrong-entity service is one of the most common causes of delay, since many exchanges operate through layered corporate structures where only one entity holds the records a subpoena actually needs.
- Criminal-only mechanisms, such as grand jury subpoenas or search warrants executed with law enforcement cooperation, move on a different timeline than civil discovery and are not available to private parties pursuing a fraud recovery case.
Anyone planning a recovery strategy around subpoena timing should build in the possibility that funds have already moved through an offshore venue before the request is even drafted, since that single fact can change the entire legal pathway.
Legal limits and defenses: Rule 45, the SCA, and Fourth Amendment caselaw
Exchanges and account holders both have real tools to resist an overbroad subpoena, and understanding those defenses helps a drafter avoid triggering them in the first place.
- Rule 45 undue burden objections allow a recipient to resist a subpoena that demands records outside a reasonable geographic radius, an unreasonable time frame, or categories unrelated to the claims at issue, and Rule 45© sets specific geographic compliance limits that a court will enforce even when the requesting party disagrees.
- The Stored Communications Act draws a line between content and non-content records. Under 18 U.S.C. § 2703, basic subscriber and transactional information is treated differently than the content of stored communications, and governmental entities seeking certain records under subsection (b) or © must show relevance to an ongoing criminal investigation rather than obtaining them automatically.
- Courts have generally found no reasonable expectation of privacy in exchange account records under the third-party doctrine. The Fifth Circuit’s decision in United States v. Gratkowski held that a Bitcoin exchange customer had no Fourth Amendment privacy interest in records voluntarily shared with the exchange, which meant no warrant was required in that case.
- Motions to quash or modify remain the primary defense tool, and a party seeking a protective order can often narrow a subpoena’s scope, shorten its date range, or limit disclosure to attorneys’ eyes only rather than defeating it outright.
A single Fifth Circuit ruling does not settle the question nationwide, since other circuits have not uniformly adopted the same reasoning, which is exactly why a subpoena’s scope and the entity issuing it still matter enormously.
First 30 to 90 days: what to do after finding a deposit address
Speed and precision matter most in the weeks right after fraud is discovered, before an exchange purges logs or a scammer moves funds further downstream.
- Preserve everything immediately, including a forensic blockchain report, screenshots of wallet activity, transaction confirmations, and any communications with the scammer, kept under a documented chain of custody.
- Send a preservation letter to the exchange as soon as a deposit address is identified, asking the platform to hold relevant account records before they roll off standard retention schedules.
- Engage a blockchain forensic or tracing resource to map the flow of funds across wallets and exchanges before drafting the subpoena, since the trace determines exactly which entity to target.
- Draft and serve a narrowly tailored subpoena built around the identifiers the trace produced, following the drafting steps above rather than a generic records request.
- Consider contacting law enforcement when the loss is significant, since a parallel criminal referral can sometimes move faster than civil process and may support a freeze request.
- Evaluate whether a temporary restraining order or preliminary injunction is warranted to lock down funds still sitting in an identifiable account before they move again.
- Track every cost incurred, and if the exchange’s production is incomplete or untimely, prepare a motion to compel rather than waiting indefinitely for a voluntary response.
Pro Tip: File the preservation letter the same day the deposit address is confirmed, because exchange log retention windows are shorter than most victims expect.
How Murphy’s Law approaches subpoenas in active fraud cases
A workable subpoena strategy typically follows a fixed sequence: forensic trace first, then a narrowly drafted subpoena, then a meet-and-confer with the exchange’s compliance or legal team, and finally motion practice or a negotiated resolution if production stalls. A litigation-first, crypto-specialized law firm has litigated matters involving Celsius, Terraform Labs, and BitMEX, and applies that same disciplined sequence to fraud recovery cases. Victims facing an exchange that has gone silent, or businesses served with a subpoena they do not fully understand, generally benefit from counsel with actual courtroom experience in crypto-specific disputes rather than a generalist unfamiliar with how exchanges actually operate.
Handling subpoenas involving privacy coins or mixer services
Privacy coins like Monero and mixing services designed to obscure transaction trails present a different set of challenges than a standard Bitcoin or Ethereum trace. Because these tools are built to break the link between sender and receiver, a subpoena aimed at a mixer often produces little more than a list of pooled addresses with no clear path back to an individual account. That does not make recovery impossible, but it usually shifts the strategy toward the exchange endpoints where funds entered or exited the mixing service, since those on-ramp and off-ramp points still require KYC under U.S. law.
Investigators and litigants pursuing funds that passed through a mixer typically issue subpoenas to every exchange touched before and after the mixing event, hoping the KYC data on either end closes the identity gap the mixer created. This approach takes longer and produces more partial results than a direct trace, and it often benefits from a forensic vendor experienced specifically with obfuscation techniques rather than a general-purpose blockchain analyst. Counsel drafting these subpoenas should expect more objections and narrower productions, since the exchange itself may have limited visibility into what happened to funds once they left its platform through a mixing protocol.
Data privacy and compliance obligations exchanges face when responding
Exchanges do not simply hand over records the moment a subpoena arrives. Most maintain internal legal review processes designed to confirm the subpoena is validly issued, properly served, and scoped in a way that does not violate the SCA’s content and notice provisions. Compliance teams routinely check whether the requesting party has followed Rule 45’s procedural requirements before producing anything, and they often push back on requests that sweep in more than the specific accounts or date ranges at issue.
Exchanges operating in the United States also carry ongoing obligations under FinCEN’s money services business rules, which shape how long records are retained and in what format they are stored. Because there is no single federal statute governing crypto exchanges directly, regulatory obligations vary by agency and by the specific conduct at issue, which means two exchanges can respond to similar subpoenas in noticeably different ways depending on their compliance posture and which regulator has jurisdiction over their specific product.
Considerations for subpoenas targeting decentralized exchanges
Decentralized exchanges present a fundamentally different subpoena target than centralized platforms like Coinbase or Kraken, largely because there is often no single corporate entity holding KYC records to subpoena in the first place. Many DEX protocols operate through smart contracts with no central operator collecting identity information, which means a subpoena aimed at “the exchange” may have nowhere to land.
Practitioners pursuing funds through a DEX typically redirect their subpoena strategy toward the edges of the transaction: the centralized exchange where the funds originated before entering the DEX, or the platform where they eventually landed after leaving it. Front-end interface operators, liquidity providers, or associated development teams sometimes hold limited data, but rarely the kind of complete KYC file a centralized exchange maintains. This distinction should shape case strategy from the outset, since chasing a DEX directly often wastes time that would be better spent tracing the centralized on-ramps and off-ramps surrounding it. A comparison of these two exchange types and how they affect legal recovery paths is available in Murphy’s Law’s guide to DEX versus centralized exchange recovery.
Why subpoenas remain central despite regulatory uncertainty
Crypto regulation in the United States remains fragmented across FinCEN, the SEC, and the CFTC, with no single agency owning the full picture. That fragmentation means exchanges respond to subpoenas with real inconsistency, some fast and cooperative, others slow and combative, depending on their internal compliance posture and which regulator they answer to. Litigators should draft every subpoena narrowly and jurisdictionally precise, because pending rulemaking and unresolved circuit splits could shift what counts as protected data before a case even reaches trial.
— Mark
How Legal counsel can help with subpoena-driven recovery
When a deposit address has been identified and a subpoena is the next logical step. The full sequence is handled in house rather than handing a victim off to a separate investigator and a separate law firm.
- Crypto fraud recovery litigation built around forensic tracing, narrowly drafted subpoenas, and motion practice when exchanges resist.
- Blockchain investigations to identify the exact accounts, addresses, and entities a subpoena should target.
- Temporary restraining orders and preliminary injunctions to freeze identifiable funds before they move again.
Bring a forensic trace or screenshots of wallet activity, the deposit addresses involved, and any communications with the scammer to an initial case review. Fee arrangements are assessed case by case, through contingency, hourly billing, or flat-fee terms, and no outcome is promised before that review.
| Service | What it addresses |
|---|---|
| Crypto Fraud Recovery Litigation | Tracing and litigating to recover stolen digital assets |
| Cryptocurrency Temporary Restraining Orders | Freezing funds before they disperse further |
| Blockchain Investigations | Building the trace a subpoena depends on |
Start with a case review at Murphyslawcrypto.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
Sources
- Federal Rules of Civil Procedure, Rule 45 (Law.Cornell)
- 18 U.S.C. § 2703 (Law.Cornell)
- United States v. Gratkowski, No. 19-50492 (5th Cir.)
- Memorandum Opinion and Order re expedited subpoenas (USDC D.N.J. Jan. 4, 2024)
FAQ
Can I get a subpoena to Coinbase?
Yes, a properly filed civil case can support a Rule 45 subpoena served on Coinbase’s registered agent, or law enforcement can use a criminal subpoena or warrant through Coinbase’s dedicated compliance channel. The request needs to be scoped to specific accounts, addresses, or date ranges to move efficiently.
Which are the legal crypto exchanges in the USA?
Exchanges such as Coinbase, Kraken, Gemini, Cash App, and Crypto.com operate as regulated money services businesses in the United States and maintain KYC and AML compliance programs. Legality generally turns on registration and compliance status rather than the platform’s name, so confirming an exchange’s current regulatory standing matters more than assuming it from reputation alone.
Can FBI track BTC wallet?
Law enforcement can trace Bitcoin transactions on the public blockchain and, with a valid subpoena or warrant, obtain KYC records from the exchange where a wallet’s funds were deposited or withdrawn. Courts have held that customers generally lack a Fourth Amendment privacy interest in exchange account records under the third-party doctrine, which supports subpoena access without a warrant in many cases.
Can you get your money back if you get scammed on crypto?
Recovery is possible in some cases through blockchain tracing, subpoenas to the exchanges involved, and civil litigation such as a temporary restraining order to freeze identifiable funds before they move again. Outcomes depend heavily on how quickly funds are traced and whether they remain in an identifiable account, so acting fast on preservation and legal filing matters more than any single guarantee.