If you lost cryptocurrency to a scammer and searched for a “John Doe subpoena,” here is the short answer: the well-known crypto “John Doe” process is a John Doe summons, it belongs to the IRS, and you cannot use it to find the person who took your money. What victims can do is combine fast evidence preservation, a forensic trace of the funds, a report to law enforcement, and, with a lawyer, a civil action that may allow court-ordered discovery against an unnamed defendant.
This guide explains the difference between those tools, why the headlines about Coinbase and the IRS do not apply to your case, and what to do in the first days after a theft.
TL;DR
- A John Doe summons is an IRS tax-enforcement tool under 26 U.S.C. § 7609(f). It needs a federal court’s approval and is not available to private victims.
- The crypto cases in the news (Coinbase, Circle, SFOX) were about unreported taxable gains, not about recovering stolen funds.
- Identifying a scammer usually runs through blockchain tracing, law enforcement subpoenas, and civil litigation led by an attorney.
- Recovery from forfeited assets is possible but slow, and it runs through a Department of Justice remission process, not a subpoena.
- Preserve screenshots, transaction hashes, wallet addresses and chats now. Everything later depends on them.
Table of Contents
- What a John Doe summons actually is
- Why the crypto John Doe cases are about taxes, not scams
- What tools can actually identify a scammer
- Why your evidence decides everything
- Beware “recovery” offers that use legal jargon
- How victims actually get money back
- Our perspective
- When a forensic investigation makes sense
- A practical sequence for the first two weeks
- FAQ
- Sources
What a John Doe summons actually is
A John Doe summons lets the IRS demand records about people whose names it does not know. The agency’s own manual says it can be useful when the activities of an unidentified person or an ascertainable group or class of persons need to be examined. It is issued to obtain the identity of a taxpayer or group of taxpayers when their names are unknown.
Three features matter for you:
- Only the IRS uses it. The statute sits in the Internal Revenue Code, in the special procedures for third-party summonses.
- A court must approve it first. The IRS has to show a federal district court that the summons concerns an ascertainable group or class, that there is a reasonable basis to believe the group may have failed to comply with tax law, and that the information is not readily available from other sources, according to the IRS manual.
- It is not a fishing expedition. The court screens it, and the target is tax compliance, not theft.
People often write “subpoena” because that is the word they know. A subpoena is a court-backed order to produce testimony or documents, and it comes in several forms. A summons is the IRS’s administrative cousin. The crypto headlines use the second word.
Why the crypto John Doe cases are about taxes, not scams
The cases that rank for this search all share one story. The IRS asked courts for permission to serve exchanges and brokers with John Doe summonses to find customers who may not have reported crypto gains.
A federal court in Massachusetts, for example, authorized a summons to Circle and its affiliate Poloniex seeking information about taxpayers who made at least the equivalent of $20,000 in cryptocurrency transactions between 2016 and 2020, according to the Justice Department. The department noted the petition did not accuse Circle of wrongdoing. The target was customers who might have under-reported income.
The long-running Coinbase dispute, brought by user James Harper, challenged this kind of summons as an unreasonable search. It matters to privacy law and to how courts treat blockchain data. It does not give a victim any new right to demand exchange records.
If a website tells you that you can “trigger a John Doe subpoena” to unmask a scammer, treat that claim with suspicion. It conflates a tax procedure with a civil discovery tool, and it may be a lead-in to a paid recovery pitch.
What tools can actually identify a scammer
The real picture is a chain of steps, each handled by a different party.
| Tool | Who uses it | What it does | Your role |
|---|---|---|---|
| Blockchain tracing | Forensic analysts | Follows funds across wallets, mixers and bridges to an exchange or cash-out point | Hire an analyst, supply transaction data |
| Law enforcement subpoena or warrant | Prosecutors, agents | Compels exchanges to disclose account holders and records | Report the crime with full documentation |
| Civil lawsuit against an unnamed defendant | Your attorney | Can open the door to court-ordered discovery from exchanges | Retain counsel, fund the case |
| IRS John Doe summons | IRS | Identifies unknown taxpayers for tax compliance | None |
| DOJ remission | Department of Justice | Returns forfeited assets to victims | File a petition when a process opens |
Blockchain tracing comes first
Public blockchains record every transfer. That is why tracing works, and it is also why courts take it seriously. In one federal appeals case, agents used an outside service to analyze the public Bitcoin blockchain and identify a cluster of addresses controlled by a website, then traced those addresses to an exchange account.
A forensic analyst does the same job for a private victim. The goal is a defensible map: your deposit, each hop, the point where funds landed at a regulated exchange or stablecoin issuer. That endpoint is what a subpoena or freeze request can be aimed at. Without it, a lawyer or an investigator has nothing specific to request.
Law enforcement subpoenas
Prosecutors identify suspects and accounts with grand jury subpoenas and warrants, not John Doe summonses. Individual victims generally cannot serve those on exchanges themselves, which is why an early, well-documented report matters. You can see in a federal forfeiture complaint how the process ends: roughly 1.2 million USDT seized from an address held at premises controlled by Tether, after tracing work tied the funds to criminal activity.
Wire fraud is the usual federal charge when scammers use the internet and bank or crypto transfers to defraud people. Read about federal wire fraud investigations to see how agents approach these cases and what contact from them looks like. That is also why your report should be organized as if an agent will read it tomorrow.
Our guide on what to report to trigger police crypto investigations walks through what agencies look for.
Civil suits and “Doe” defendants
In civil court, plaintiffs who do not know a defendant’s name sometimes sue “John Doe” and ask the judge for permission to take early discovery, including from exchanges, to learn who the person is. Whether that is available, and how a court views it, depends on the jurisdiction, the facts, and the judge. This is a decision for a licensed attorney who handles digital asset fraud, not something to attempt on your own. A subpoena to an exchange that cannot be tied to a specific address or transaction is likely to be weak, which is again why the trace comes first.
The difference between civil and criminal tracks affects what evidence you need, and we cover it in evidence first in civil and criminal crypto fraud.
Why your evidence decides everything
Every route above starts with the same raw material. Investigators, prosecutors and your attorney will all ask for:
- Transaction hashes and the wallet addresses you sent to
- Screenshots of chats, emails, websites, apps and profiles, with dates
- Exchange or bank statements showing the transfers
- Phone numbers, usernames, domains and payment instructions the scammer gave you
- A written timeline in your own words
Don’t delete the app, don’t wipe the phone, and don’t keep chatting with the scammer. Websites vanish quickly. Our checklist on saving evidence in the first 72 hours and the shorter 24-hour steps for stolen crypto lay it out in order. If you need the court-facing side, see digital evidence preservation and admissibility.
Report to the FBI’s IC3 and your local police, and file with the FTC. A written report number helps when an exchange or bank asks what you have done.
Beware “recovery” offers that use legal jargon
Victims are prime targets for second scams. The FTC reports that in 2023 there were over 330,000 reports of business impersonation and nearly 160,000 of government impersonation, totaling more than $1.1 billion in losses. The same FTC page describes a common pattern: someone claiming to be an official tells you to move your crypto to “protect” it, often through a Bitcoin ATM or a private wallet.
A fake “court officer” who says a John Doe subpoena has been issued and you must pay a fee or deposit crypto to release funds is running that pattern. Real courts and agencies do not collect fees in crypto, do not ask you to move funds to a safe wallet, and do not contact you out of the blue to demand payment. If you get such a message, stop, keep it as evidence, and report it.
Also be careful with anyone who guarantees recovery. Tracing can produce evidence and leads. It cannot promise a result, because freezing or returning funds depends on third parties and on courts.
How victims actually get money back
Recovery paths are narrower than most people hope, and they are slow.
Freezes and voluntary holds. If funds are traced to a regulated exchange or stablecoin issuer quickly, a law enforcement request may lead to a hold. Speed is the main variable.
Forfeiture and remission. When the government seizes and forfeits criminal proceeds, the Justice Department can set up a remission process. The department says victims of a scheme can petition for compensation once assets are forfeited. In the OneCoin matter, victims had until June 30, 2026 to file. In the Terraform Labs case, the U.S. Attorney’s office explains that remission is a separate process from bankruptcy claims and that victims should keep records of their financial loss.
If you want to understand the other side of these wire fraud cases, such as how defendants challenge charges, wire fraud defenses explains the legal arguments, which also shows why prosecutors need clean, well-sourced evidence from victims.
Civil judgments. A judgment is only worth something if you can find assets to collect against. Tracing again.
Chargebacks and card disputes. Where the payment went through a card or a payment processor, a dispute may be available in some cases. See our overview of crypto chargebacks.
None of these is quick. Anyone who says a recovery will land in a set number of days is guessing.
Our perspective
We get this question from victims who have read a news story and believe a subpoena is a switch someone can flip. It isn’t. A subpoena is only as good as the facts behind it, and the facts come from the blockchain and from what the victim saved.
What we see in practice is that cases are won or lost on three things:
- How early the evidence was preserved. Chats and sites disappear. Wallet histories do not, but the context around them does.
- Whether the trace reaches a named service. A report that ends at an unlabeled wallet is a dead end. One that ends at a specific exchange deposit, with each hop explained, gives counsel and agents something to act on.
- Whether the report is built for a reader who doubts it. Courts and opposing counsel ask how a conclusion was reached. Our approach is to document method, sources and limits, so another expert could check the work.
We also tell people plainly what we cannot do. We are a forensic firm, not a law firm, and we cannot issue subpoenas. Our role is the technical investigation and the report that your attorney or the authorities can use. For the techniques behind that, read our pages on blockchain forensics and wallet activity analysis for court.
— cristian
When a forensic investigation makes sense
Hire an investigator when you have a defined loss, transaction hashes or wallet addresses, and a realistic next step such as a police report, a civil claim, or a request to an exchange. Our cryptocurrency scam investigation and evidence preservation services cover tracing, OSINT attribution and technical reports. Law firms can use our forensic support for professional offices, including technical reports built for legal proceedings. Pricing is set per engagement, so there is no published fee to quote here.
If you are a lawyer who needs reports that stand up under evidence rules, our guides on using crypto forensics in court and blockchain evidence admissibility are a good place to start.
A practical sequence for the first two weeks
- Stop contact and secure accounts. Change passwords, enable two-factor authentication, and move any remaining funds only from a clean device.
- Capture evidence. Hashes, addresses, screenshots, statements, a dated timeline.
- Report. IC3, local police, the FTC, and the exchange or bank you used. Keep the report numbers.
- Get the trace. A forensic analyst follows the funds and flags any regulated endpoint.
- Talk to an attorney. Ask specifically about civil claims against unnamed defendants, early discovery, and whether a prompt request to the receiving exchange makes sense.
- Watch for remission notices. If your scam is tied to a prosecuted scheme, check Justice Department announcements and keep your loss records ready.
For a longer walk-through, see our step-by-step crypto fraud investigation guide.
FAQ
Can I file a John Doe subpoena to find a crypto scammer?
Not as a John Doe summons: that is an IRS procedure and needs court approval for a tax investigation. A private victim may, through an attorney, be able to sue an unnamed defendant and ask the court for early discovery. Whether a judge grants it depends on your facts and jurisdiction.
Is a John Doe summons the same as a subpoena?
No. A summons is the IRS’s administrative demand for records, while subpoenas are issued in criminal and civil proceedings. Both compel production of information, but the rules and the people who can use them differ.
Can the IRS John Doe summons help me recover stolen crypto?
No. Its purpose is to identify taxpayers who may not be complying with tax laws. It does not return stolen funds or identify scammers for victims.
Does law enforcement subpoena crypto exchanges?
Yes. Prosecutors use grand jury subpoenas and warrants to identify account holders and obtain records. Victims generally cannot do this themselves, so a thorough report with traced transactions improves the odds that an agency takes action.
Can victims get money back from forfeited crypto?
Sometimes. When the Justice Department forfeits assets from a prosecuted scheme, it may open a remission process where victims petition and prove their loss. It is not available for every scam and it takes time.
Sources
- IRM 25.5.7, Special Procedures for John Doe Summonses (IRS)
- IRM 25.5.1, Introduction (IRS)
- 26 U.S. Code § 7609 (Cornell LII)
- Court authorizes John Doe summons on Circle (U.S. Department of Justice)
- Fifth Circuit opinion on blockchain analysis (No. 19-50492)
- Forfeiture complaint, W.D. Missouri (U.S. Department of Justice)
- Impersonation scams: not what they used to be (FTC)
- OneCoin victim compensation process (U.S. Department of Justice)
- United States v. Kwon, Terraform Labs (SDNY)
