CITATION: Nivora Group LLC v. Ping et al, 2026 ONSC 2943
SUPERIOR COURT OF JUSTICE - ONTARIO
RE: NIVORA GROUP LLC and ACTION ACTION ACTION LLC
AND:
TANG PING, WILLIAM FUWEI (also known as QI FUWEI, WILLIAM QI, and WILLIAM WANG), and THOMAS ZHAI (also known as LIAOGAO ZHAI)
BEFORE: Merritt J.
COUNSEL: Brendan D. Peters, Sohaib M. Habib, for the Plaintiffs
Tanya Walker, Dora Konomi, Robert Benjamin Halperin, for Defendants
HEARD: May 1, 2026
ENDORSEMENT
OVERVIEW
1The Plaintiffs bring a motion for an equitable remedy of pre-action discovery, commonly known as a Norwich order: see Norwich Pharmacal Co. v. Customs and Excise Commissioners, [1974] A.C. 133 (H.L.); Rogers Communications Inc. v. Voltage Pictures, LLC, 2018 SCC 38, [2018] 2 S.C.R. 643, at para. 18. The Plaintiffs are claiming fraud and submit that a Norwich order is urgently needed to trace and preserve assets wrongfully taken by the Defendants that are at a high risk of dissipation.
2The Defendants submit that there is no urgency and a Norwich order is not warranted or needed because the Plaintiff can obtain the relevant information through the usual discovery process either from the Defendants directly or by way of a motion for production from non-parties pursuant to r. 30.10 of the Rules of Civil Procedure, R.R.O. 1990, Reg. 194.
3This action arises over a dispute with respect to a crypto asset.
4The Plaintiff Action Action Action LLC is incorporated pursuant to the laws of the State of New York, United States of America, with no employees and a sole director. AAA was incorporated to serve the needs of a wider movement called the Himalayan Farm Alliance Committee (the “Community”), comprised of volunteers who peacefully advocate against the Chinese Communist Party (the “CCP”).
5The Plaintiff Nivora Group LLC is incorporated pursuant to the laws of Sharjah Media City, Sharjah, United Arab Emirates. On or about June 27, 2025, Nivora purchased AAA’s assets, this action. Nivora had no involvement in the facts of this claim prior to its purchase of AAA’s right of action.
6The Defendants are individuals living in Thornhill and Markham and are influencers in the Community. The Defendants have extensive experience in art and blockchain development.
7The Plaintiffs and the Defendants agreed that the Defendants would create a crypto asset token for the Plaintiffs. The token they created was called TDCCP, short for “Take Down the Chinese Communist Party”. The Defendants worked with several anonymous non-parties during the TDCCP project and all parties understood that the anonymous parties would remain anonymous.
8TDCCP is what is colloquially known as a “meme coin”. Meme coins have no inherent financial value and TDCCP is no different. TDCCP is described in the White Paper outlining it as a collectible that would be emblematic of the community’s advocacy against the CCP. However, similar to other collectibles like trading cards or Beanie Babies, the price of a meme coin can fluctuate with changes in demand.
9To convert a TDCCP token into cash (cash in a recognized national currency is referred to in the crypto asset world as a “fiat currency”), the TDCCP token would have to be traded for a more common crypto asset that could then be exchanged for a fiat currency. There are two of these crypto assets relevant here:
USDC, which is a crypto asset that is set to be of equal value to the US Dollar; and
SOL, a token commonly used on the Solana blockchain (on which TDCCP was made) and at the relevant time period was worth approximately USD $140.
10Practically what was intended was that someone would obtain possession of a quantity of TDCCP and convert that quantity of TDCCP into either SOL or USDC and then convert the SOL or USDC into a fiat currency.
11The parties documented their agreement in a White Paper. In the crypto asset world, white papers are “pitch” documents that outline the nature and purpose of the crypto asset, its technical and economic features, its development plan, and the community that developed it. In this case, the White Paper stated how TDCCP was to be distributed:
Phase 1: 1% of the tokens given to members of the community (5 million tokens);
Phase 2: 10% of the tokens publicly available through a public mint (64 million tokens);
Phases 3 and 4: 10% of the tokens put in a liquidity pool (64 million tokens);
Phase 5: Another 10% of the tokens through an expansion (64 million tokens);
64% of the tokens held in lock-up (412 million tokens); and
5% of the tokens distributed to the development team for “team operations” including technology development, marketing & promotion, and community building (32 million tokens, referred to as the “Community Fund”).
12The Defendants say the Community Fund included all operational costs, including compensation for the development team.
13The Plaintiffs say although the Community Fund included “some reward” for the developers, the Plaintiffs needed to expressly authorize any disbursement of the tokens for this purpose.
14On February 20, 2025, the Defendants “minted” the entire fixed supply of 640 million TDCCP tokens, in keeping with the White Paper.
15The parties agree that the phases were implemented and that the lock-up (i.e. period during which sale, trading or transferring of the tokens is prohibited) is in effect, with the tokens being released in stages through August 2027.
16The Parties agree that between March and May of 2025, some of the TDCCP was converted into USDC and SOL and then transferred to the 22 wallets with respect to which the Plaintiffs seek the Norwich order (the “Subject Wallets”). Of these 22 Subject Wallets, the Defendants state in their materials that they control 20.
17The value of SOL and USDC transferred to the Subject Wallets is USD $6,229,741.84. These transactions all occurred on the Kraken platform. Kraken is a registered crypto asset trading platform in Ontario.
18It is unclear what happened after the SOL and USDC was transferred into the Subject Wallets. This is the subject of the Plaintiffs’ enquiry.
19One subset of these transactions involves the Community Fund. The parties agree that the Plaintiffs distributed 32 million TDCCP to the Defendants on March 4, 2025. These funds were initially deposited into a wallet with the first four characters 9oXY, which the defendant Tang controlled. From 9oXY, five million TDCCP was transferred to a wallet with the first four characters F3cY and then converted into 309,307.44 USDC. This 309,307.44 USDC was then transferred into three of the Subject Wallets, all three of which are controlled by the Defendants. The parties disagree over whether this initial transfer to wallet 9oXY was the Community Fund.
20The Plaintiffs allege that all the funds transferred to the Subject Wallets were misappropriated and that the Defendants profited from the misappropriated funds while they were in the Defendants’ possession.
21In May 2025, the Defendants “handed off” the private keys for wallets containing the majority of the TDCCP to the Plaintiffs, meaning the Defendants gave the Plaintiffs control of these wallets.
22The Plaintiffs now seek a Norwich order regarding the Subject Wallets to determine what happened to the funds placed in them.
23The Plaintiffs seek the Norwich order against the Kraken Exchange and the VirgoCX Exchange. The Plaintiffs expert says that the Defendants moved at least $8,725,464.02 Canadian Dollar (“CAD”) equivalent in property belonging to the Plaintiffs in relation to the TDCCP project to various accounts at centralized cryptocurrency exchanges, including the Kraken Exchange and the VirgoCX Exchange (collectively the “Exchanges”).
24The Defendants submit that through transactions not mentioned in the Plaintiffs’ materials, they sent the Plaintiffs SOL and USDC worth over USD $14,700,000, which is more than the approximately USD $6,200,000 that the Plaintiffs claim is unaccounted for. The Defendants submit that the Plaintiffs’ materials did not capture these transactions because the transactions occurred off of the Kraken platform.
25The Plaintiffs do not dispute that the transactions as described by the Defendants took place, but submit that there is an additional USD $3,131,111.66 million worth of SOL (22,243.77 SOL) that the Plaintiffs sent to the Defendants that is unaccounted for.
26The Plaintiffs say that even if cryptocurrency has been sent back to them, it was sent back in a different form and they need to know what happened while any misappropriated cryptocurrency was in the Defendants’ possession.
27The Defendants say that the Plaintiffs seek to bypass the discovery process and the obligation to post security for costs and seek to harass the Defendants and publicize sensitive information. The Defendants say the Plaintiffs have induced others to harass them on social media and sent protesters to the Defendants’ homes, forcing them to move.
28The Plaintiffs do not deny directing others to make social media posts, rather they deny directing specific content and exact wording. After several weeks of protests at the Defendants’ homes, the Plaintiffs began offering each protestor $50 per day. The protests were livestreamed to thousands of viewers.
29The Defendants believe their lives are in danger given the death threats on social media, and that this motion is a pretext for a fishing expedition to reveal sensitive information about the Defendants and the anonymous parties.
30The Defendants also say that the identities of the owners of the wallets to whom the Defendants eventually transferred tokens would not be accessible through a Norwich order, since they are wallets about which the Exchanges will have no information beyond their wallet addresses.
31The Defendants served a cross-motion for a sealing order. At the hearing of the motion the parties agreed that the cross-motion would be adjourned, to be heard, if necessary, following the release of my decision. The Plaintiffs objected to passages in the Defendants’ factum that refer to material from the cross-motion. It was not necessary for me to refer to this material to decide the motion.
THE ISSUE
32The only issue is whether a Norwich order should be made.
DECISION
33The Plaintiffs’ motion for a Norwich order is dismissed.
ANALYSIS
34A Norwich order is an equitable remedy and a form of discovery that strictly speaking is not injunctive relief. Under a Norwich order, a plaintiff may obtain discovery from a person including a person against whom there is no cause of action in order to identify a wrongdoer and to obtain information about wrongdoing so that the plaintiff may bring proceedings or at least consider whether to bring proceedings: GEA Group AG v. Ventra Group Co., 2009 ONCA 619, 96 O.R. (3d) 481, at para. 41; Isofoton S.A. v. Toronto Dominion Bank (2007), 2007 14626 (ON SC), 85 O.R. (3d) 780 (S.C.), at para. 40; Norwich Pharmacal.
35Section 96(1) of the Courts of Justice Act, R.S.O. 1990, c. C.43 provides: “Courts shall administer concurrently all rules of equity and the common law”. The equitable action for discovery co-exists with the procedural rights under the Rules of Civil Procedure: GEA Group AG, at para. 52, citing Straka v. Humber River Regional Hospital (2000), 2000 16979 (ON CA), 51 O.R. (3d) 1 (C.A.), at paras. 27, 32.
36Canadian Courts have identified the following possible purposes of a Norwich order:
to identify wrongdoers;
to find and preserve evidence of a wrongdoing or even to determine whether an action exists; and
to trace and preserve assets.
Alberta Treasury Branches v. Leahy, 2000 ABQB 575, 270 A.R. 1, at para. 106, aff’d 2002 ABCA 101, 303 A.R. 63, leave to appeal refused [2002] S.C.C.A. No. 235; GEA Group AG, at para. 50.
37A Norwich order is “an intrusive and extraordinary remedy that must be exercised with caution”: GEA Group AG, at para. 85. It is a “a powerful tool, to be used sparingly and only where necessary”: Jacobs v McGee, 2023 ONSC 2765, at para. 17.
38The requirements for a Norwich order are:
the plaintiff must have a bona fide claim or potential claim against a wrongdoer;
the person against whom the Norwich order is sought must have a connection to the wrong beyond being a witness to it;
the person against whom the Norwich order is sought must be the only practical source of the needed information;
the party seeking the disclosure must compensate the person against whom the Norwich order is sought for all expenses arising out of the discovery; and
the interests of justice must favour obtaining the information.
Rogers Communications, at para. 18; Franco v. TD Canada Trust, 2021 ONSC 7237 at para. 11; GEA Group AG, at para. 51.
39The fundamental principle underlying the Norwich order is that the party against whom the order is sought has an equitable duty to assist the applicant in pursuing its rights: GEA Group AG, at paras 50, 51 and 62, Isofoton S.A., at para. 40; Enbridge Gas Distribution Inc. v. The Toronto Dominion Bank, 2008 13363 (Ont. S.C.), at para 7.
40The overarching question is whether the disclosure sought is a necessary measure under the circumstances to permit the applicant to pursue its rights against the wrongdoer, including to obtain the identity of a wrongdoer, to evaluate whether a cause of action exists, to plead a known cause of action, or to trace assets: GEA Group AG at paras. 91-92.
41The threshold for the requirement of a bona fide claim is low, requiring only that the claim not be “frivolous or vexatious”: Isofoton S.A. at para. 42.
42I am satisfied that the Plaintiffs have established a bona fide claim against the Defendants for breach of contract, misappropriation of crypto assets and breach of trust. They have a bona fide claim that AAA was in a position of vulnerability to the Defendants because of its director’s relative lack of sophistication with respect to crypto assets. The Plaintiffs have a bona fide claim that the Defendants transferred all of the Community Fund to wallets controlled by them and members of the project team and refused to transfer community building tokens to members of the Community when requested to do so by the Plaintiffs. Whether these claims will ultimately succeed remains to be seen and is not the question here. It is enough that the Plaintiffs have met the low bar of establishing the claims are not frivolous or vexatious.
43The Exchanges have a connection to the alleged wrongs beyond being witnesses to them. Norwich orders may be made against financial institutions to obtain bank records: Isofoton at paras. 35-37. Following this logic, Norwich orders may also be made against crypto asset exchanges in the case of crypto asset-related fraud: Hao Chen et. al v. Masih Moazen-Safaei, 2025 ONSC 3098, at para 21.
44The Plaintiffs have agreed to indemnify the Exchanges for their costs.
45I am not satisfied that obtaining information from the exchanges is the only practicable source of the requested information.
46The Plaintiffs say the Exchanges are the only practicable sources of the information and rely on Isofoton for the proposition that “where the Plaintiff believes it is the victim of fraud, it is unreasonable to require the Plaintiff to approach the alleged wrongdoer for the information”: para 52. This reasoning does not apply here where the Plaintiffs have brought their motion on notice to the Defendants. The Defendants have not refused to provide information. They have provided a significant amount of information by way of affidavit evidence and cross examinations. They can be asked more questions at discovery.
47If the discovery process is unsatisfactory, the Plaintiffs may bring a motion for production from the Exchanges under r. 30.10 of the Rules of Civil Procedure if they can satisfy the three-part test: a) the document is not privileged b) the document is relevant to a material issue in the action and c) it would be unfair to require the Plaintiffs to proceed to trial without having discovery of the document.
48The Plaintiffs say that the Norwich order would save “the parties expenses related to a costly and foreseeably contentious discovery process to access the same information in the possession of the Non-Party Exchanges.” Saving the parties money is not the purpose of a Norwich order.
49A Norwich order is “not intended nor should it be permitted to serve as a substitute for the normal discovery regime”, and it “is not intended as a device to circumvent the normal discovery process which can effectively achieve the same result”: GEA Group AG at para. 104, citing B. (A.) v D. (C.), 2008 ABCA 51, 429 A.R. 89, at para. 16.
50Often motions for Norwich orders are brought ex parte and combined with a Mareva injunction to prevent dissipation of misappropriated funds pending trial. This is far from a typical Norwich motion.
51In this case the Plaintiffs know the identity of the Defendants, have sued them, and brought the motion for a Norwich order on notice to the Defendants. They do not seek a Mareva injunction, a preservation order, or other injunctive relief.
52The Plaintiffs are bringing the motion for a Norwich order to trace any unaccounted for crypto assets and obtain the identity of the owners of the wallets to which the unaccounted crypto assets were sent. Although they do not expressly say so, I assume the Plaintiffs are also interested to know what happened to any misappropriated cryptocurrency that has been returned to them while it was in the Defendants’ possession for the purpose of advancing disgorgement damages.
53The Plaintiffs say the crypto assets wrongly in the hands of the Defendants are at a high risk of dissipation. Bringing the motion on notice to the Defendants seems inconsistent with this submission as does the Plaintiffs’ delay in bringing this motion.
54The Plaintiffs have known about the assets they are seeking to trace since at least May, 2025. They commenced this action on October 23, 2025. The Defendants filed their Statement of Defence of November 17, 2025. The Plaintiffs did not retain an expert until February 19, 2026.
55The parties, through their counsel, engaged in discussions regarding a discovery plan and motion for security for costs between January 6, 2026 and March 18, 2026.
56The draft discovery plan included production of:
All documents pertaining to on-chain activity relating to the TDCCP token, including, but not limited to, … [a]ll records relating to transactions involving centralized cryptocurrency exchanges, including the identity of the account holder(s), bank accounts connected to the account and all deposit and withdrawal information since January 2025.
57The parties were in discussions regarding the discovery plan and a motion for security for costs when the Plaintiffs served their motion materials for this Norwich motion.
58The Plaintiffs did not agree to the Defendants’ request for security for costs and sought a date for an urgent motion on March 23, 2026 on notice to the Defendants. The motion for security for costs was scheduled for April 30, 2026 before an Associate Judge and this motion for a Norwich order was scheduled for May 1, 2026. On this motion, both parties filed affidavit evidence, conducted extensive cross examinations, and delivered factums. The Plaintiff filed an expert report and the Defendants cross-examined the Plaintiffs’ expert. There are over 6,000 pages of material uploaded to CaseCenter.
59The Plaintiffs are attempting to circumvent the discovery process. The Plaintiffs do not now need further information to commence an action against the alleged wrongdoers. They have already identified the alleged wrongdoers. They are seeking third-party productions without knowing whether the Defendants can produce the requested information.
60The Defendants will know what they did with the assets after they transferred them to the Subject Wallets. They will also know how much profit they made.
61At this point it is far from clear that any “tracing” of assets is required given that the Defendants may have transferred to the Plaintiffs assets of greater value than the amount the Plaintiffs claim is “unaccounted for”. In any event, if there are unaccounted for assets that were truly at a high risk of dissipation as alleged by the Plaintiffs, they have likely long since been dissipated given the Plaintiffs’ delay in bringing this motion.
62I do not accept that a Norwich order is necessary. The purpose of a Norwich order is not to assist the Plaintiffs in substantiating their claims, quantifying their damages, or determining the extent of the alleged breach of the provisions of the White Paper.
63I am not satisfied that the interests of justice favour granting the Norwich order. The Plaintiffs have not demonstrated that a Norwich order is necessary and the balance tips in favour of protecting the privacy of the Defendants and those wallet holders to whom the Defendants have transferred assets.
64Where an account holder has acted fraudulently, courts have held that they are not entitled to the protection of the confidentiality normally afforded to bank records: Isofoton at para. 60. Here there is no allegation that the other wallet holders have acted fraudulently.
65At this time, the Plaintiffs’ interest in disclosure does not outweigh the interests of the unknown wallet holders including their interest in privacy and confidentiality. The public interest does not justify disclosure at this time and the interests of justice do not favour granting a Norwich order.
66As set out above, the Plaintiffs are in the USA and the UAE and the Defendants are in Thornhill and Markham.
67The Rules of Civil Procedure now require that proceedings be commenced at a court office in a county with which there is a rational connection on the basis of specified factors: r. 13.1.01(2).
68The court may, on its own initiative, order that the proceeding be transferred to the county where it should have been commenced: r. 13.1.02.
69This proceeding was commenced in Toronto. On the face of it, there does not seem to be a rational connection to Toronto but this was not apparent when the motion was scheduled.
70The parties shall contact my Judicial Assistant to arrange a case conference before me under rule 50.13 for the purpose of considering whether an order should be made transferring this case to Newmarket.
COSTS
71I encourage the parties to agree on costs. If they cannot agree, I will consider brief written submissions. These costs submissions shall not exceed five pages in length, (not including any bills of costs or offers to settle). The Defendants shall deliver their written submissions within ten days of the date of these reasons. The Plaintiffs’ responding submissions shall be delivered within five days of receipt of the Defendants’ costs submissions. Any reply submissions shall be delivered within three days of receipt of responding submissions and shall be no more than three pages long. Costs submissions shall be served, filed with the court, and delivered to me by way of email to my Judicial Assistant.
Merritt J.
Date: May 22, 2026