How to Subpoena Coinbase, Binance & Kraken for Stolen Crypto

A subpoena to a centralized exchange is often the single highest-leverage step in a stolen crypto case. The blockchain shows where funds went; the exchange tells you who owns the wallet that received them. Without exchange records, on-chain tracing ends at a deposit address. With them, it ends at a verified human identity.

This guide walks attorneys (and sophisticated victims) through what records each major exchange holds, how to draft a subpoena that actually produces useful data, and how Coinbase, Binance, Kraken, Gemini, and Bitstamp each respond in practice.

When a Subpoena Is the Right Tool

Three preconditions should be in place before issuing a subpoena:

1. Identified deposit address. A blockchain forensic report has traced the stolen funds to a specific deposit address controlled by a specific exchange. Without this, you're fishing.
2. Active legal proceeding. A subpoena is a coercive court process — it must issue from a filed civil case, criminal investigation, or grand jury proceeding. There is no "pre-litigation" subpoena to a third party in U.S. practice.
3. Specificity in scope. A well-drafted subpoena names accounts, addresses, and date ranges. Overbroad requests get quashed or partially refused.

If you don't yet have an identified deposit address, the prerequisite is forensic tracing. We cover what that looks like in how blockchain forensic investigators trace stolen crypto.

What Records Crypto Exchanges Actually Hold

Major regulated exchanges hold more data on their users than most banks. AML and KYC obligations under FinCEN regulations, the Bank Secrecy Act, and (for European entities) AMLD5 require multi-year retention of identity and transaction data.

The categories worth subpoenaing:

Standard retention is 5-7 years post-account closure. Don't assume an old account's records are gone — most major exchanges keep them well beyond statutory minimums.

Civil vs. Criminal Subpoena Authority

Three vehicles get records out of an exchange:

Federal Civil Subpoena (FRCP Rule 45)

Once a civil case is filed, a Rule 45 subpoena duces tecum compels production from a non-party. For Coinbase (Delaware-incorporated, headquartered in California), service can be made via their registered agent or designated compliance contact. Federal civil subpoenas have nationwide reach within the U.S.

State Civil Subpoena

State courts can issue subpoenas under analogous state rules. Cross-state service typically requires domestication under the Uniform Interstate Depositions and Discovery Act (UIDDA). If you're filing in a state where the exchange has no presence, expect domestication friction.

Federal Criminal / Grand Jury Subpoena

Issued by federal law enforcement (FBI, IRS-CI, Secret Service, HSI) through the U.S. Attorney's Office. These are the fastest-responding subpoenas — often produced within 7-14 days — but they require an active federal investigation, which most victims don't have unless their case has been adopted by a federal agent. Filing with IC3 and pursuing an FBI referral is sometimes the path here.

What to Ask for in the Subpoena

The mistake most attorneys make is requesting "all records related to" an account. Exchanges interpret broad requests narrowly and produce the minimum. Specific, enumerated requests get more.

A useful subpoena requests, by enumerated paragraph:

1. All KYC documents submitted by the account holder of [account ID, deposit address, or email if known], including but not limited to government identification, proof of address, and selfie verification images.
2. All transaction records for the account from [start date] to [end date], including deposits, withdrawals, internal transfers, trades, and any associated counterparty wallet addresses.
3. IP address, device fingerprint, and geolocation logs for all login sessions during the same period.
4. All bank accounts, credit cards, debit cards, and other payment instruments linked to the account, including last verified status and dates of linkage.
5. All support tickets, secure messages, and account communications between the account holder and the exchange.
6. Any internal risk flags, AML alerts, or compliance notes attached to the account.
7. Records of any account suspensions, fund holds, or withdrawal restrictions, with dates and reasons.
8. The account-creation date, the IP address used during account creation, and any referral or affiliate tracking associated with the account.

If you've identified the deposit address but not the underlying account, ask for "the user account associated with the deposit address [0x...]" — exchanges can map deposit addresses to accounts internally.

How Each Major Exchange Responds

Offshore Exchanges and MLAT Requests

If the deposit landed at an offshore exchange that won't respond to a civil subpoena, the formal route is a Mutual Legal Assistance Treaty (MLAT) request. This is a treaty-based mechanism where the U.S. asks a foreign government to compel production of records on its behalf.

Limitations to be aware of:

• Criminal-only. Most MLATs are restricted to criminal investigations. Civil litigants generally cannot trigger an MLAT directly — you need a federal investigator handling the case.
• Slow. MLAT requests typically take 6-18 months. By the time records arrive, funds have usually been moved or withdrawn.
• Jurisdiction-dependent. A treaty must exist with the jurisdiction in question. Several offshore crypto-exchange jurisdictions have weak or no MLATs with the U.S.

For pure civil cases against offshore-deposited funds, the practical path is often: identify the deposit address, file the civil case naming the wallet as the defendant (in jurisdictions that permit in rem actions), and pursue the funds at the next chokepoint — often a regulated exchange they're moved to next.

When the Exchange Resists

Common objections and how to counter them:

"Subpoena is overbroad"

Narrow the request to specific account identifiers, date ranges, and enumerated record categories. Move to compel only after meet-and-confer.

"Privacy / Stored Communications Act"

The SCA (18 U.S.C. § 2702) restricts production of message content but generally does not protect non-content account records (KYC, transaction logs, IP). Cite this distinction in your reply brief if records are withheld.

"User has been notified and objects"

Some exchanges notify account holders unless the subpoena includes a non-disclosure order. If anticipated, include a request for delayed notice (18 U.S.C. § 2705) in criminal matters or move for a protective order in civil.

"Records are held by foreign affiliate"

Common for Binance and certain offshore exchanges. Verify which legal entity actually holds the records — sometimes a U.S. subsidiary has access. Otherwise, MLAT is the formal route.

Realistic Timelines

From the moment you have an identified deposit address, expect:

• Subpoena drafting: 3-7 days for an experienced attorney with the forensic report in hand.
• Service & receipt confirmation: 2-5 days through portal submission.
• Initial response: 14-30 days for major US exchanges; longer for offshore.
• Meet-and-confer / scope refinement: 7-14 days if requests are objected to.
• Final production: 21-60 days from initial subpoena for cooperative exchanges.

If asset preservation is the priority, start earlier than the records request. A separate preservation letter or asset-freeze motion goes to the exchange concurrently with the subpoena. This is the difference between identifying the scammer and actually recovering funds.