Zonda: The Cold Wallet as an Alibi. The Blockchain Shows BitBay’s Real Wallets

Robert Nogacki, attorney at law, Kancelaria Prawna Skarbiec · September 12, 2026

On June 26, 2025, in the office of a notary in Villefranche-sur-Mer, on the French Riviera, Przemysław Kral signed a one-page declaration that his company had “unlimited, full and exclusive access” to a Bitcoin wallet holding 4,503 coins, and attached, as proof, a screenshot from a public blockchain explorer. Ten months later, the same man announced on camera that the company did not have the keys to that wallet, because the exchange’s vanished founder was to hand them over and, in the chief executive’s words, “instead of doing so, disappears.” The notarized page, which now sits in the file of an Estonian bankruptcy court, changes nothing about the keys. It changes something else: it shows that the address beginning 16aEn4p6 was not an improvisation of April, 2026, but a prop the management had been using, on the auditor’s own figures, at least since the accounts for 2023, and before a notary in 2025, to close questions from auditors, from bookkeepers, and, in the end, from customers. The company’s own spreadsheets show how much was left without the prop: at the end of 2024, a little over a third of what it owed its customers; at the end of 2025, three per cent. Meanwhile, the real wallets of BitBay, the Polish exchange that later became Zonda, one of them labelled BitBay.net in the public WalletExplorer database and two more tied to it by their flows, are sitting in plain view in that database, from the first customer deposits in March of 2014 to the summer of 2021. They breathe the way any exchange’s wallets breathe: deposits in, withdrawals out, top-ups in round lots. And in seven years of breathing, the public record contains not a single satoshi that passed between them and the address the chief executive put on the screen. If this address was ever the reserve meant to cover the deposits, then on the public record that reserve never took part in the life of the exchange. That moves the whole story back by six years. The question is no longer who has the key. It is what happened to the bitcoins of BitBay’s customers between 2016 and 2022, because if that reserve never worked, then it is there, and not in March of 2022, that the beginning of the insolvency has to be looked for; and why, for a decade, nobody was expected to investigate, when it was so much easier to believe that everything was sitting in a cold wallet.

This is the third piece about this address, and each answers a different question. The first, on the ghost wallet and the “Suszek has the keys” narrative, I wrote within hours of Kral’s video of April 16, 2026, and it explained why this address does not fit an exchange’s cold wallet: a cold wallet breathes, taking in surpluses in a boom and giving them back in a bust, while this one has not made a single spend since March of 2016 and has not received a single meaningful deposit since. The second, on Zonda’s cold wallet, came after the on-chain analysis and showed what the address does fit: an aggregation cluster that gathered five and a half thousand bitcoins in wholesale lots over seven weeks of 2016 and set 4,434 of them aside at this address, with a hub that, on the day of one of those deposits, sent a thousand coins to Russia’s BTC-e; hence two hypotheses, a key lost in 2016 and a wallet that was never the company’s. This third piece no longer asks whose wallet it is. It asks what it was for. The answer comes from the document from the Riviera and from the spreadsheets with which the company closed the question of coverage year after year: the address was an alibi, the one line without which the balance sheet would not have closed at all.

A Notary on the Riviera Certifies Ten Years of Silence

The attachment to the declaration is one sheet: a printout from mempool.space, turned ninety degrees on the page, with the notary’s stamp and signature laid over the chart. In the address bar, and again in the heading, the same thirty-four characters: 16aEn4p6hK4FMpLtJGpoQZMZ946sDg1Z6n. Confirmed balance: 4,503.25874912 BTC, valued at $479,272,822, which works out to roughly $106,400 a coin; Bitcoin traded at that level in the last days of June, 2025, but also in January and in May of that year, so the price does not date the screenshot. UTXOs: 28. That number dates it better than the price: the address had exactly 28 unspent outputs only between December 29, 2024, and June 30, 2025, when two more crumbs of dust arrived; the screenshot was taken inside that window, to which the date of the declaration belongs. Address type: P2PKH. And two lines that say everything: “Total received” is equal to “Confirmed balance.” Nothing has ever left.

Below is a chart titled “Balance History”: a flat line from the left edge to the right, past the tick marks for 2017, 2018, 2019, and onward to 2025. The left edge is March of 2016, the month the address received its coins. A tooltip hovers over the last point on the chart and records the most recent thing that ever happened here: December 29, 2024, 1:08 P.M. Central European Time (the computer on which the screenshot was taken was set to the time zone of Warsaw and Nice, not Tallinn), an incoming transfer of 547 satoshi, about half a dollar. Dust, of the kind that analytics bots sprinkle on famous dormant addresses. The twenty-eight UTXOs visible on the screenshot are two deposits from 2016 and twenty-six such crumbs; more have been sprinkled since.

The chief executive, in other words, attached to a declaration of full and exclusive access a picture of nine years in which that access, if it existed, had never once been used to move a coin. The notary certified that the signature under the sentence belonged to Przemysław Kral; about the sentence itself the notary knows nothing and is not required to, because in this procedure one certifies the signature, not the truth. Any of the eight billion people on earth can open that page, print it, and carry it to a notary. None of them will thereby become the owner of 4,503 bitcoins.

The letters “P2PKH” deserve a word, because part of what follows depends on them. They denote the oldest type of Bitcoin address, the kind that begins with the numeral 1 and can be spent with a single signature. In 2016 it was the standard format; SegWit, the upgrade that introduced newer address types, arrived only in August of 2017, and BitBay’s own wallets used addresses of this kind as well. So the format does not rule out an exchange. It merely shows no sign of what the industry had treated as the security standard since 2015: exchanges that took care of their reserves were already keeping them, in 2016, on P2SH addresses, the ones that begin with a 3, which can encode a multi-signature script in which spending requires several keys held by several people. The script of an address does not tell you everything about the procedures around the key, but it tells you that one person’s signature is enough. Bitstamp moved to that model after it was hacked in January of 2015; BitGo had been selling it to exchanges since 2014. A reserve on one key is a reserve that one person can lose. We will come back to that.

What the screenshot does not contain matters as much as what it does. There is no signed message. The ability to sign a message with the key to a P2PKH address has long been available in Bitcoin Core and in the common wallets, Electrum, Trezor, Ledger; the owner of the key signs any text he likes, “BB Trade Estonia OÜ, June 26, 2025,” say, and anyone can verify the signature in seconds without moving a satoshi. Nor is there a micro-transaction to a designated address, a test commonly proposed in proof-of-reserves practice since the collapse of FTX. What there is, instead, is a balance “as of December 31, 2024,” stated in the declaration to the last satoshi and identical to the on-chain balance on that date. The figure reads as if copied from the explorer. That much effort sufficed to put the document into the company’s files, and, a year later, into a court’s.

This third piece I am writing with documents in hand. We now know that the address was not born to the company in April of 2026 but had been shown to the auditor: the euro figure in the auditor’s qualification for 2023 is, arithmetically, this address’s balance at the year-end price, which puts it in the books at least since that audit, though the report names no address; the notarized declaration of June 26, 2025, was drawn up for the 2024 accounts, four days before the filing deadline, and for the same accounts the company prepared a wallet reconciliation marked “for auditors.” We also know what BitBay’s real wallets looked like, and we know, from the company’s own figures, how much was left in its wallets without this address. The document from the Riviera answers not the question of ownership but the question of use: what viewers watched in April of 2026 was not a discovery but the première of a prop that had been in use backstage for years. The chief executive said as much himself in the same video, as money.pl reported: “The address, which is in all the audits that have been carried out, has been verified by the audits.” It was meant to reassure. Read after the documents, it describes a function.

The Exchange Was Breathing Somewhere Else

You know an exchange’s wallet by its breathing. Customer deposits flow into deposit addresses; the exchange sweeps them into an operating wallet; from the operating wallet it pays customers who withdraw; surpluses go into cold storage; and when withdrawals exceed deposits, the exchange reaches back into storage. In April I described this mechanism in general terms, as an industry standard, and pointed out that the address 16aEn4p6 does not breathe. Today one can show something better: where BitBay did.

WalletExplorer, a public tool that groups Bitcoin addresses into wallets on the basis of common spending, maintains a page called BitBay.net: 321,245 transactions carrying the exchange’s name. The first dates from March 29, 2014, the opening weeks of the platform in Katowice. In April, I wrote that this page covered the years 2019 to 2025; that was an error, and I correct it here. The cluster’s substantive activity falls in the years 2014 to 2019; after 2019 its activity is sparse: a few small outgoing transfers in 2020 and stray entries as late as 2025. Its earliest pages are a catalogue of customers depositing fractions of a bitcoin, 0.02, 0.4, 0.85, each swept within the hour into a single wallet to which WalletExplorer gave no name but an identifier: [002a0239d0].

That wallet is BitBay’s lungs for the years 2014 to 2016. It contains 8,962 transactions, the last on January 12, 2016. In December of 2015 the BitBay.net cluster feeds it in round lots, 50, 80, 90, 100, 130, 150 bitcoins, several times a week, and the same day or the next it pays them out to customers in the amounts customers asked for: 89 bitcoins here, 4 there, 2 to the Russian exchange BTC-e in December, and, in the neighboring months, about 10 to LocalBitcoins and 3 to Bitcurex in Łódź in November, a few thousandths to the darknet market AlphaBay in January. The balance rarely exceeds 350 bitcoins. This is what a withdrawal wallet looks like at an exchange in its second year: topped up as needed, emptied as it goes, no reserves lying around for months.

After January 12, 2016, that wallet falls silent, and the next one takes over the breathing. Its identifier is [0014c5c3f2]: 6,656 transactions, regular traffic until July 30, 2021, and, after thirteen months of silence, two final transactions on September 7, 2022. Its connection to BitBay follows from the flows. Its first funding, on January 10, 2016, came directly from the BitBay.net cluster, two days before the old wallet fell silent; on January 12 it sent a small sum back to that wallet, the kind of handover one sees when one machine replaces another; and in 2020 it was fed in round lots of 20 to 100 bitcoins, mostly from one recurring unlabelled wallet and a handful of others, at least one of which was itself fed from BitBay.net, and paid them out the same day. The rhythm is the one from five years earlier, only the sums are larger, and the withdrawals go out in bundles of 40, 70, 90 bitcoins. In the summer of 2020 the top-ups came roughly once a week.

And now the sentence for which it was worth reading those pages. In all that breathing, from March of 2014 to the summer of 2021, and in the two stray transactions of September 2022, the address 16aEn4p6 does not appear once. It does not feed the withdrawal wallets, because it has never sent anything; that is certain, and it comes from the chain. Nor is it fed from the BitBay.net cluster or from the exchange’s operating wallets: the only two material sources of its funds are an aggregation cluster active from January to March of 2016 and a deposit of 69.2586 bitcoins from a wallet, [89547e98ce46121f], that had itself sent nine of the 122 inflows into that cluster, the rest being dust, and neither carries the BitBay.net label, though the label was being assigned in those very weeks to the deposits of the exchange’s customers. In April of 2026, WalletExplorer saw what we see today: an exchange with a recognizable infrastructure, and an address connected to that infrastructure by no visible flow. The clustering in that database rests on a common-spending heuristic and can miss infrastructure that spends its coins separately; that is why I write of the absence of a visible link, not of proof of non-ownership.

One more pair of dates deserves noting without conclusions attached. The regular traffic of the wallet [0014c5c3f2] stopped on July 30, 2021; after thirteen months of silence came two final transactions, on September 7, 2022, and nothing since. That pair of transactions required a signature six months after Suszek’s disappearance: whatever happened to the cold-wallet key, the keys to the exchange’s operating wallets worked without him. The interim trustee dates the company’s possible permanent insolvency to the end of 2022, from the loss of access to the cold wallet. Where the exchange moved its operating infrastructure in the summer of 2021, and who held the keys to the new one, is a question for the trustee, who alone has the power to ask it and be answered.

For seven years the exchange breathed deeply, just not with the lung it showed the doctor.

The Wallet Was Born in March of 2016 and Cannot Be Older

The address 16aEn4p6 received its coins in two deposits: 4,434 BTC on March 6, 2016, at 8:03 in the morning, Universal Time (txid 4d1a1058…), and 69.26 BTC nine days later (txid b86e1c73…). The first of these transactions gathered a hundred and six inputs from seventy-six addresses of a single wallet, identified in WalletExplorer as [033a676d6f50f05c], and paid 4,434 BTC to the address 16aEn4p6, leaving a second, small output that looks like change. That wallet lived for about seven weeks: from January 15 to March 5, 2016, it took in a hundred and twenty-two deposits, from three-quarters of a bitcoin to a hundred and eighty, some 5,500 bitcoins in all, from dozens of different addresses; it paid out twice along the way, on January 20 and February 8, and on March 6 it was emptied to zero in three transactions: 434.45 BTC at 06:30 Universal Time to another wallet, and, ninety minutes later in a single block, 4,434 BTC to the address 16aEn4p6 and 541.27 BTC to a third wallet. Collection, consolidation, transfer to an address that would never move again. The pattern is that of a business aggregating funds, and in April I called it by its name; it is not the pattern of a private individual.

But the business has to be looked at next to the real BitBay of the same month. In 2014 the customers of the Katowice exchange were depositing tenths of a bitcoin, and in December of 2015 the exchange was gathering deposits into lots of 50 to 150 BTC. Into the wallet [033a676d6f], meanwhile, flowed amounts from under one to 180 BTC, in a hundred and twenty-two transactions, over seven weeks, an average of about 45 BTC apiece. That is the profile of wholesale: an over-the-counter desk, another exchange, one large customer spreading funds across addresses. It is not the profile of retail at a Polish platform with seven employees and six hundred and five thousand złoty of annual revenue, the company whose disappearance I traced in a piece on how BitBay vanished in front of everyone (in Polish). Four and a half thousand bitcoins were then worth about $1.8 million, a dozen times the operator’s annual revenue. Scale does not exclude an exchange, since customer deposits are always a multiple of commissions. What tells against it is the shape of the stream: somebody was pouring bitcoins into this wallet by the bucket, and BitBay’s customers were carrying them in by the teaspoon. It is not the size of the lots that decides the matter, since an exchange sweeping its surplus into cold storage also sends consolidated lots; what decides it is that the 122 senders are one-off, unlabelled wallets, and not one of them is BitBay.

One of the larger payments into the cluster arrived on February 1, 2016, at 5:31 in the afternoon, Universal Time, in a transaction (txid acd7b553…) that combined four inputs and paid 180.57 BTC to an address of the aggregation cluster; all four inputs belonged to a single wallet, and the largest of them, 65.054 BTC, came directly from its hub, 1MmkA1u…, an address with ninety-eight transactions of its own, belonging to a cluster of more than eight thousand addresses through which large sums moved. On the same day, ten and a half hours earlier, at 6:53 in the morning, the same cluster had paid a thousand bitcoins (txid 53a3bccd…) to an address in the BTC-e.com cluster; 750 of that thousand came from the hub itself, the rest from six of its sister addresses. BTC-e was the Russian exchange one of whose operators, Alexander Vinnik, pleaded guilty in federal court in 2024 to conspiracy to commit money laundering; according to the Department of Justice, the exchange processed more than nine billion dollars in transactions between 2011 and 2017. In April I called this the Russian trail, and I stand by every word about what is visible on the chain. I add one caveat that I could not add then, because I did not yet know BitBay’s wallets: the Katowice exchange’s own withdrawal wallet also sent bitcoins to BTC-e, twice in December of 2015, 2 BTC and 0.05 BTC, because customers of Polish exchanges kept accounts there. A transfer to BTC-e therefore says only that the sender, or the sender’s customer, had an account at BTC-e. A thousand bitcoins in a single transfer, about $370,000, is not, however, a retail customer’s account. It is the account of someone who, in February of 2016, was moving, in a single transaction on that exchange, sums of the order of the largest balance that BitBay’s visible withdrawal wallet held in January of 2016. Who that was, Chainalysis, Elliptic, or TRM Labs can say, because in their databases the hub presumably has a name. In the public database it has only a number.

The calendar yields one more thing, and it is an argument that this series has not made before. BitBay began accepting customers’ bitcoins in the spring of 2014. The address 16aEn4p6 came into being in March of 2016. It cannot, therefore, be the exchange’s cold wallet “from the beginning”; for the first two years, whatever reserves BitBay had must have been somewhere else. This address could at most be a cold store opened in 2016 and, as we are about to see, opened in order that nothing be put into it ever again. The certificate of reserves that Sylwester Suszek signed in June of 2021, which I described in a piece on the loan contracts and the money from Suszek’s exchange, gives 4,513.93 BTC at the end of 2020, 10.67 bitcoins more than the address has ever held, with no address, sourced to “Funds Monitor,” the company’s internal system. It is a printout from a database, not from the chain. The only place where this address and this company meet on paper is the declaration of June, 2025. Before that they met only in an auditor’s arithmetic, to which we will return.

A Thought Experiment: A Cold Wallet Lost in 2022

Let us accept, for a moment, everything the company says. The address 16aEn4p6 is BitBay’s cold wallet. Sylwester Suszek, the founder, had the key. He disappeared on March 10, 2022, and the key disappeared with him, or, in the version given to the trustee, access was lost at the end of 2022. From that moment the company could not reach its reserve, and that is why it is not paying customers today. That is the company’s scenario. Let us test it on the chain, because the chain is the only witness that testifies without counsel.

An exchange’s cold wallet has two functions, and both leave traces. First, it takes in surpluses. When customers deposit more than they withdraw, the exchange moves the difference from the operating wallet into cold storage, because keeping hundreds of bitcoins on a machine connected to the Internet is an invitation to burglars. Second, it gives back. When, in a bull market, customers withdraw more than they deposit, the exchange reaches into storage. The wallet 16aEn4p6 never performed the second function; we have known that since April. But it never performed the first, either. The last real deposit was on March 15, 2016. From that day until March of 2022 the address did not accept a single bitcoin, only dust.

Lay BitBay’s history over those six years. In 2016 the company had seven employees. In 2017 its revenue grew from six hundred and five thousand to 42.6 million złoty, seventyfold, while Bitcoin went from a thousand dollars to nineteen thousand; the cash in the Polish company’s filed accounts rose that year to forty million złoty, customers’ money on my reading of those accounts. In 2018 came the bear market and a wave of withdrawals. In 2020 and 2021, the second bull run, more than a million registered users, by the exchange’s own account. Throughout all of it, the cold wallet, by the company’s own account the only significant asset it had, received not one top-up and gave back not one satoshi, while the exchange’s visible operating wallets were being refilled several times a week from other sources. A reserve that does not grow in a boom and does not shrink in a bust is not a reserve. It is a number in a spreadsheet.

Here lies the resolution of the thought experiment. If the address 16aEn4p6 ever belonged to BitBay, then the most economical reading is that the key to it stopped working not in 2022 but by the spring of 2016, because nothing else explains as simply six years of boom and bust without one top-up and without one withdrawal. The competing explanation, a strategic reserve deliberately left untouched while other wallets did the work, is weakened by the top-ups rather than refuted: a reserve meant to cover deposits would be expected to grow as deposits grew by orders of magnitude, and after March of 2016 this one received nothing but dust. The chain cannot exclude that other reserves sat at addresses not identified here. The company’s own balance sheet can, and does: it knows no other. Suszek ran the exchange, by all accounts, until Kral took over in 2021. Had he held the key and needed the coins, one would expect to see them move; six years of non-use has a price in liquidity and commissions. That is an argument from commercial sense, not evidence of who held the key. If, on the other hand, the address never belonged to BitBay, the key was never the exchange’s to lose, in 2016 or in 2022. In either variant, the version “we lost access at the end of 2022” describes, at most, the moment at which the management’s own account places the loss. It does not describe an event on the chain, because a lost key leaves no trace there; the chain shows no spend from this address at any date, and no material receipt after March of 2016.

The company has offered four dates in this matter. The blockchain: no spend from the address at any date, and no material receipt after March, 2016; receiving coins needs no key, so the chain has never once seen this address’s key at work. The chief executive on camera: March, 2022, the key vanished with the founder. The chief executive to the trustee: loss of access, which the report dates to the end of 2022. The chief executive before the notary: June, 2025, access full and exclusive. The last three versions come from the same author and exclude one another, unless the word “access” meant something different in each. The first is not a date at all but an absence: a key can sit in a drawer for years, used or unused, and the chain will not know. It comes from a machine that has no stake in the matter and has never heard of a correction.

In April I called the possible loss of the key in 2016 an operational error, the first layer of the whole construction. I stand by that as to the mechanism and withdraw it as to the weight. An operational error is not certified before a notary nine years later as an asset. An error that sits in the accounts, at least since the year for which the auditor’s figure matches this address, as ninety-eight per cent of the company’s reported crypto-assets, stops being an error and becomes a method.

The Trail in the Books: 2016 Without a Write-Down, 2017 Without a Profit, 2018 Without Cash

If the exchange lost access, in 2016, to four and a half thousand of its customers’ bitcoins, a trace had to remain somewhere. Not on the chain, since a lost key looks, on the chain, like silence. In the books. The financial statements of BitBay sp. z o.o. for 2015 through 2020 sit in the document repository of Poland’s National Court Register, and I read them in August, writing about the vanishing of the Katowice company (in Polish). They arrange themselves into three pictures.

The year 2016: nothing. The balance sheet knows no write-down, no provision, no financial cost on the order of the dozen or so million złoty those bitcoins were then worth. Customers’ cryptocurrencies do not appear in the Polish company’s books at all; customers’ złoty pass through general line items, bitcoins nowhere. Because the coins were never recognized as the company’s assets, their loss would not appear as an impairment. It would not, however, be invisible: an obligation to return assets one can no longer deliver is a liability, or at the least a provision and a note. There is none, and that absence is itself a finding.

The year 2017: a profit that isn’t there. Revenue of 42.6 million złoty, operating profit of 33.5 million, and then financial costs of 32.7 million, including a line marked “Other” for 29,953,985 złoty, without one word of explanation in the notes. Financial costs eat ninety-eight per cent of the operating profit; the unexplained “Other” row alone eats eighty-nine per cent of it. The simplest explanation, which I proposed in August, is this: that is what the books look like at an operator that takes customers’ złoty at five thousand dollars a bitcoin, pays out at fifteen thousand, and does not have the bitcoins in storage. An operator with cover earns in a boom. An operator without it books “other financial costs.” Thirty million złoty was, in 2017, about eight million dollars, roughly the price, depending on the month, of one to two thousand bitcoins. The figure cannot be assigned to any particular wallet, so I mark it as a hypothesis. But it is a hypothesis that fits a hole shaped like 16aEn4p6.

The year 2018: cash that walked out. Forty million złoty of cash at the end of 2017 turns, within a year, into two million of cash and 103 million złoty of receivables and loans extended to “other entities,” meaning parties outside the group, with no names; I returned to the debtor who wasn’t on the books in September, when one of the exchange’s borrowers was arrested. In 2018 the operator announces its move to Malta, where BitBay Malta turned out to be a company that existed only on paper, then to Estonia, and on February 17, 2026, the Katowice company is struck from the register without liquidation. Anyone who wants to know where BitBay’s customers’ money is should be asking about those 103 million, not about Suszek’s key.

The Estonian statements add an epilogue, which I described in a piece on Zonda’s loans and the auditors’ opinions. For 2021 the auditor declined to give an opinion. For 2022, a qualified opinion: cryptocurrencies worth a hundred and fifty-five million euros, partly held by third parties. For 2023, another qualification, this time with a figure: a hundred and seventy-two million euros of cryptocurrencies identified, but with no way to verify that the group exercised control over them, sitting in a “wallet belonging to the group’s platform” about whose owner no independent party could say anything, and a management that, in place of proof, had offered a notarized declaration, which the auditor did not accept. Four thousand five hundred and three bitcoins at the price on December 31, 2023, about thirty-eight thousand euros apiece, come to a hundred and seventy-two million euros. The auditor’s figure and the value of this address’s balance are the same number; the report names no address, but the statements know no other wallet that would produce it. This is arithmetic, not a line item, but it is arithmetic indicating that the address from the Riviera had been sitting in the Estonian company’s books at least since the audit for 2023. The proposal was made during the audit of the 2023 accounts, which were filed on June 30, 2024. The declaration we know was signed a year later, on June 26, 2025, four days before the Estonian deadline for filing the 2024 accounts; whether an earlier one existed, we do not know. The opinion for 2024, issued by the same auditor, is clean. Whether the auditor relied on that page I do not know and do not claim. I know when the page came into being and what is on it.

Bookkeeping has this property: it asks whether the numbers add up, not whether the key is in the drawer. They added up, year after year.

One Address Closed the Books

The last word in this matter belongs to the trustee, or rather to the documents he described. From his report, discussed in a piece on Kral’s reply to the trustee, it follows that the exchange’s external accountant had no access to the wallets, booked aggregate sums supplied by the management once a quarter, and himself admitted that the books do not reflect reality. Those aggregate sums take the form of spreadsheets titled “Balances x Wallets”: on one side the company’s wallet balances, on the other the sum of customer balances, at the bottom the difference. One was prepared for the auditor with the 2024 accounts; two more for the bookkeeper, as of September 30 and December 31, 2025. They are working documents of the management, not of the auditor, and that is precisely what makes them valuable: they show how the management explained to itself that everything added up.

As of December 31, 2024, the sheet sums up: wallets 650.3 million euros, customer balances 649.8 million, a surplus of half a million. The agreement is the product of two operations. The first is netting across assets. The company reported 4,582 bitcoins, among them the 4,503 of the address from the Riviera and 60 at BitGo, against 2,887 owed to customers: a surplus of 1,696 coins, worth 152.7 million euros at the year-end price. With that surplus the sheet covers shortfalls everywhere else: customers were owed 37,600 ether, the company held 17,600, a gap of 64.8 million euros; 5.7 million XRP were missing, and 11.3 million USDC. The crypto shortfalls add up to 99 million euros; the bitcoin surplus exceeds them, so the column agrees, though a customer who kept ether on the exchange was covered by bitcoins at an address from which nothing has moved in a decade.

The second operation concerns money. The company held 4.0 million euros in currencies on its accounts and owed customers 74.3 million; the shortfall of 70.2 million euros is entered in the sheet outright, in a cell of its own, without comment. It was plugged with a line called “Admi wallets”: 66.3 million euros in cryptocurrencies, chiefly 10,200 ether, 9.1 million XRP, and 8.4 million USDT, added to the company’s own funds. AdmiTrade is a character known from this series, a party to the loan agreements I have written about. In the Estonian register, AdmiTrade OÜ has a share capital of 2,500 euros, one board member, no revenue for 2023, a former name of ICEO CAPITAL EST-1 OÜ, and an address at Tähesaju tee 9 in Tallinn, the same address Kral gave the notary as the seat of BB Trade Estonia. In the 2025 sheet the company calls it an “external market maker.” An external market maker from under the company’s own roof supplied, on paper, nearly all of the customers’ missing cash. A year later the “Admi wallets” line is gone from the sheets, and nothing says where it went.

In 2025 the mechanism kept working, with less and less to cover on one side and more and more on the other. As of September 30, wallets and customer balances agree to within 42,000 euros: the crypto shortfalls had grown to 233.9 million euros, including 95.3 million in ether, 47.7 million in XRP, and 34.0 million in USDC, and the bitcoin surplus, at a price of 97,000 euros, to 232.2 million. As of December 31, 2025, the company reported 4,517 bitcoins against 2,072 owed to customers, 179 ether against 26,910, 82,000 XRP against 22.7 million, 962,000 USDC against 49.1 million. Coverage in ether: seven-tenths of one per cent. In XRP: four-tenths. In USDC: two per cent. In bitcoin: 218 per cent. Without the address from the Riviera, the wallets held 14 bitcoins plus cryptocurrencies and cash worth about 10 million euros in all, against 343 million euros owed to customers at the sheet’s prices (how the courts will recompute those balances is the subject of my piece on what a claim is worth when no one has counted it); a year earlier it had still been 245 million. Customers’ currency balances fell over the same period from 74.3 million to 2.9 million euros, and the sheet at the end of 2025 shows those balances agreeing with the bank accounts to within four-thousandths of a euro, a precision no live exchange achieves unassisted.

The exports from the custody systems add one finding that puts the whole series in order. On January 1, 2025, the Fireblocks vaults from which the exchange ran deposits and withdrawals held 0.000012 bitcoin; both permanent Bitcoin addresses of the vault labelled “COLD” were empty. Bitcoin was handled by the second custodian, BitGo, which held 59.9. The address 16aEn4p6 has received nothing but dust since March of 2016, so customer deposits of 2017 to 2024 cannot have gone there. Of the 2,887 bitcoins owed to customers at the end of 2024, 60 were in the company’s custody. The rest of the cover was an address that no flow connects to those deposits.

The arithmetic of the reconciliation was simple: one line had to be large enough and never shrink. On one side of the sheet customers withdrew ether, XRP, and cash, so the wallets melted away; on the other the address from the explorer endured, and when the price of bitcoin rose, so did the surplus with which the next gap could be covered. Mrożek would have added that this was the only reserve in the world that customer withdrawals could not deplete, because nobody ever withdrew from it.

The Alibi: What a Wallet Nobody Holds Is For

Let us ask the question I put to every document in this series: whom does it serve, and how? Not in the moral sense; in the mechanical one. What does the sentence “our customers’ funds are in the cold wallet 16aEn4p6, we just don’t have the key” do in the world, when it is spoken by the chief executive of an exchange at the moment the exchange has stopped paying out and its support desk is sending the email that said too much?

What follows is a hypothesis about function, not a finding about intent. The sentence does three things. First, it moves the question. The customer, the journalist, the prosecutor, and the trustee who had been asking “where are the bitcoins?” have been asking, since April 16, 2026, “where is the key?” Those are two different investigations. The first runs through BitBay’s books for 2016 to 2018, through thirty million złoty of financial costs and a hundred and three million in loans and receivables from unnamed parties, through the Estonian loan agreements with Admitrade and Orion, through the 82.7 million euros of “use of customer funds” in the 2024 balance sheet, with which I began my post-mortem of the exchange that promised to keep your coins safe, and through the question of who signed the transfers. The second runs to a man who vanished in the town of Czeladź, near Katowice, and cannot contradict anyone. The first investigation has documents and names. The second has a legend.

Second, it turns a process into an event. An insolvency that, on this hypothesis, built up over years, with withdrawals met from the deposits of the customers who came after, becomes, in this telling, a misfortune that fell from the sky on one day in March of 2022. Misfortunes have no perpetrators. Processes do. The version with the vanished key shifts the weight of blame from a management that took deposits for years without cover onto a fate that carried off the founder. There is something of QuadrigaCX in this, the Canadian exchange I wrote about in the cold-wallet piece: there, too, the keys “died” with the chief executive, and Ernst & Young, as court-appointed monitor, later reported that the cold wallets had been effectively empty since April of 2018, eight months before his death.

Third, it holds up the balance sheet. As long as 4,503 bitcoins are carried as an asset, the company is solvent on paper, the auditor has something to lean on, the license continues, new customers keep depositing, and old obligations are paid out of new inflows. An address that cannot be moved has, from the standpoint of such a construction, one virtue: it cannot run out. A real reserve shrinks with every withdrawal. A reserve from a block explorer never shrinks. It is the perfect asset for a balance sheet that is meant to agree not with reality but with the audit. The sheets for 2024 and 2025 show this in figures: quarter by quarter the customers’ ether, XRP, and cash drained away, and the one line that never drained covered an ever larger share of the rest.

The declaration of June, 2025, shows that this function was being performed long before the withdrawal crisis. The management did not discover this address in a panic in April of 2026. On the available material it had been relying on it before the auditor for 2023, if the arithmetic holds, before the notary in 2025, before the auditor for 2024 in a reconciliation marked “for auditors,” in which the address is the one line that closes the balance, before the bookkeeper in the quarterly statements, and before the court in 2026. The version for the public, “Suszek has the keys,” appeared only when the public demanded what the auditor had never managed to extract: proof of control. As long as believing was enough, nobody investigated. An alibi is the more effective the more it demands faith in place of verification; this address demanded faith, and for as long as the record goes back it got it.

I do not claim that this was planned in 2016. I claim that this is how it worked, and an effect does not ask about intent. Przemysław Kral, according to press reports from August, is giving extensive statements to prosecutors; I asked in July whether Zondacrypto’s Przemysław Kral would turn crown witness, and in August, when his defense promised it, I took inventory of Kral’s “vast fortune”; TVP Info reported that he had obtained the status of a so-called small crown witness, prosecutors have declined to confirm his procedural status, and the Minister of Justice said on September 8 that he is neither a crown witness nor a witness but is testifying in the proceedings. He will therefore have the opportunity to say which of the four dates he considers true, and to explain what the address from the Riviera was doing on the company’s balance sheet during the years in which nobody was using it.

What a Chief Executive Who Has Lost Access Is Supposed to Do

Set aside for a moment the question of whose wallet it is, and take the version most favorable to the management: the exchange kept four and a half thousand of its customers’ bitcoins at one address and, on a certain day, lost access to them. What does a management that does not intend to break the law do then?

It does three things, in this order, without undue delay. First, it writes the loss down. An asset whose recovery is no longer probable is impaired and disclosed, and the obligation to return it to customers becomes a liability or a provision. Second, it closes the door. An exchange whose obligations to customers permanently exceed what it can realize cannot go on taking new deposits, because every new deposit becomes the source of a withdrawal for an old customer, and the platform becomes a mechanism in which the last to arrive pay for the first. Third, it files for bankruptcy. Estonia’s Commercial Code (äriseadustik, section 180(5¹)) requires the management board of a private limited company to file without delay, and no later than twenty days after the day on which permanent insolvency became evident. Twenty days, not four years. Since December 30, 2024, the European Union’s MiCA regulation has set the standard for crypto-asset service providers: safeguard clients’ assets (Article 70), keep custodied crypto-assets separate from your own, and answer for their loss where it results from an incident attributable to you (Article 75). Providers already operating under national registration had a transitional period, which in Estonia ran to July 1, 2026, and the Estonian supervisors confirmed on June 30, 2026, that MiCA’s requirements do not apply to providers without an authorisation; for BB Trade the standard was therefore law in the Union before it became a binding duty of the firm, and until then the firm was bound by Estonia’s rules for virtual-currency service providers, by the Commercial Code, and by the accounting framework. On the public record, none of the three things happened at any of the three dates the company itself has offered. In place of a write-down there was a notarized declaration. In place of a closed door there was an advertising campaign with brand ambassadors, the same trick twice in the history of Poland’s financial system. In place of a bankruptcy petition there was a petition by a customer from Vienna. Opening proceedings on it in July of 2026, in what I described as the Zondacrypto insolvency in Estonia, the court in Tallinn wrote that the debtor had “publicly announced that it has no access to the virtual wallet containing cryptocurrencies, which is its only significant asset”; with the Zondacrypto bankruptcy declared on August 27, it put the liabilities at 431.9 million euros as of April 22, 2026, computed from tax debt and April accounting data because the source documents were not produced, against identified assets on the order of a hundred and sixty-seven thousand, mainly at balances of March 31, 2026, as TVN24 reported.

This is why the question of the key, fascinating as it is, has no bearing on the management’s responsibility. If the key exists, the management has been making false statements since April of 2026 and is withholding from customers assets it holds. If the key vanished in 2022, the management spent three and a half years taking deposits without cover instead of filing within twenty days. If it vanished in 2016, the management did that for ten years. If the wallet never belonged to the exchange, the management did it from the start, and wrote someone else’s coins into its own balance sheet besides. A fifth version, an honest confusion about which wallet the accounting line referred to, would be the strangest of all for a figure certified under criminal liability. In each of the four, the question for the chief executive is the same: whether he continued the operations of an entity that he knew, or should have known, could not pay. That is a question for a court, and it does not depend on where the key is. The story of the key changes which chapter of the code the court will open, not whether it opens one. The prosecutor’s office in Katowice, as it said in announcing its investigation, opened its investigation on April 17, 2026, on the notifications of injured customers, into fraud (Articles 286 and 294 of the Criminal Code) and money laundering (Article 299), with the damage put at not less than 350 million złoty, over conduct from 2022 onward; on July 30, 2026, the National Prosecutor’s Office merged the Zondacrypto and Suszek cases into one investigation. From this article it follows that the period should be checked from 2016.

How the Hole Deepened

The spreadsheets and exports I have drawn on above say more than the alibi thesis needed. I gather the rest in seven parts at the end, so that the main line stays legible; a reader who has had enough of the main line can go straight to the list of questions. What follows is material for the trustee and the prosecutors: what happened to customers’ assets in 2025, whose hands they passed through, and how it was written up in the books. I give no employees’ names; roles, yes.

The Baseline: The Reserve Certificate of 2021

The reserve certificate that Sylwester Suszek signed on June 18, 2021, which I described in the piece on the loan agreements, certifies the state of the company’s wallets as of December 31, 2020, according to the internal system Funds Monitor, BitGo statements, and Etherscan screenshots. Set against the sheets for the end of 2024 and 2025, it gives a third point in time and makes it possible to date when each asset disappeared.

Bitcoin: a cold wallet of 4,513.93 BTC, 10.67 more than the balance of the address from the Riviera. In the sheet for 2024 the “Other” column equals that address to the satoshi. The same line served as cover under two chief executives for five years, and the 10.67 BTC of surplus from 2020 had vanished by 2024; the simplest reading is that a second cold address existed, and that someone was able to empty it. Ether: 51,646.73 in the cold wallet and 790 in the hot one, 52,400 ETH in all at the end of 2020. At the end of 2024 the company held 7,400 in its own custody and 10,200 “at AdmiTrade,” against 37,600 owed to customers. Thirty-five to forty-five thousand ETH were gone, worth 110 to 145 million euros at end-2024 prices. The certificate knows no customer balances, so it does not settle whether ether was fully covered at the time; if it was, the hole in ether opened between 2021 and 2024, not in 2016. XRP: 21.7 million in the cold wallet at the end of 2020; 20.4 million at the end of 2024, 9.1 million of them at AdmiTrade and 7.99 million outside the custodians; 82,000 at the end of 2025. Bitcoin Cash: 14,000 at the end of 2020, 4,700 at the end of 2024, 54 at the end of 2025. Bitcoin Gold: 126,000 at the end of 2020, 6,900 in 2024, and nothing at all in customer balances by then.

There is also a control group. The NEU token: the certificate reads 774,906.10, but the Fireblocks COLD vault held 2,774,906.10 on January 1, 2025, a match to a tenth of a token; the scan swallowed the first digit, and the balance had not moved in four years. Litecoin: 68,238 in the cold wallet at the end of 2020 against 28,321 in Fireblocks plus 40,000 of “own funds” at the end of 2024, 68,321 in all, a match to within a tenth of one per cent. DASH, ZEC, XLM, BAT, and LSK were covered at close to one hundred per cent at the end of 2024; only in 2025 did they melt too, DASH from 18,100 to 1,600, ZEC from 10,200 to 63. The pattern is legible: what the company really controlled it moved into Fireblocks in 2021 and kept until the end of 2024; it did not move the bitcoin from the Riviera, and it did not keep the ether, the XRP, or the Bitcoin Cash. The hole sits in the most liquid assets, not where the keys were supposed to have gone missing. And the “Other” column of the statement for the auditor, holding, apart from the address from the Riviera, 7.99 million XRP, 4,001 BCH, 170 ether, and 40,000 LTC, is most probably the remnant of the Funds Monitor cold wallets under private keys; their addresses, and who held the keys, are the first question for the trustee.

The Year 2025: The Wallets Melted Faster Than the Liabilities

Between December 31, 2024, and December 31, 2025, the company’s wallets lost ninety-nine per cent of their XRP, ninety-nine per cent of their DOGE, ninety-eight per cent of their ADA, ninety-nine per cent of their TRX, ninety-one per cent of their SOL, ninety-five per cent of their LTC, and ninety-nine per cent of their ether. Customer balances in the same assets fell, over the same period, by nine to thirty-two per cent. Part of the difference is explained by the disappearance of the “Admi wallets,” which at the end of 2024 held 10,200 ether, 9.1 million XRP, and 8.4 million USDT. The rest has no explanation in the sheets: wallets other than AdmiTrade’s lost 11.2 million XRP while customers reduced their balances by 3.4 million; 47.6 million DOGE against 5.8 million; 7.9 million ADA against 1.5 million; 18.8 million TRX against 4.6 million; 53,600 SOL against 7,800. At end-2024 prices, this excess of outflow over withdrawals is worth about fifty million euros.

USDC balances behaved the other way round. Customers held 18.3 million at the end of 2024 and 49.1 million at the end of 2025, 30.8 million more, while the company held first 7.0 million, then 0.96 million. Bitcoin balances fell by 814 coins, and the wallets lost 65. Both figures describe the same phenomenon: trading inside the platform, in which a customer’s bitcoin or ether was converted into an entry in a stablecoin. Such a conversion does not touch the wallets; it moves the liability from a column where there was cover on paper to a column where there was none. Customers were fleeing to a stablecoin inside the exchange, and the exchange was not buying what it was crediting to their accounts.

Cash forms a similar picture. Customers’ currency balances fell from 74.3 million euros at the end of 2024 to 15.8 million on September 30, 2025, and 2.9 million at year-end; the balance on the accounts rose, over the first three quarters, from 4.0 to 15.8 million. To reduce its obligations to customers by about fifty-eight million euros, 13.7 million of which is AdmiTrade’s balance vanishing between quarters, and still raise its cash by twelve, the company had to find between fifty-six and seventy million euros. Over the same period, cryptocurrencies that nobody had withdrawn vanished from the wallets. The sheets do not record that one financed the other; they record both figures side by side. Where the coins went is known to the Fireblocks and BitGo exports for 2025, which the trustee can pull with a single command.

AdmiTrade on Both Sides of the Sheet

AdmiTrade appears twice in the sheet for December 31, 2024. On the liability side as a customer: 39.0 million złoty and 4.6 million euros in currency balances, 13.7 million euros in all, and 5.4 million ZND worth 3.0 million. On the asset side as the owner of the “Admi wallets”: 10,225 ether, 9.11 million XRP, 8.40 million USDT, 2.83 million USDC, 19.2 bitcoin, 2,281 SOL, 69,000 DOT, and 635,000 ADA, 66.3 million euros in all, added to the exchange’s own funds. Without that line the sheet would have been sixty-five million euros out of balance. If the coins in those wallets were the subject of the agreements I described in the piece on the loan agreements with Admitrade and Orion, then a receivable from a counterparty was entered as though the coins were still sitting in the exchange’s wallets; if they were not, somebody else’s property was added to the exchange’s own funds.

The Estonian commercial register has known AdmiTrade OÜ since September 7, 2021: first as Norion OÜ, from January 31, 2022, as ICEO CAPITAL EST-1 OÜ, and from August 22, 2022, under its present name. Share capital of 2,500 euros, one board member, since September 2, 2023, a sole shareholder, ICEO RED 0 OÜ, a company of the Kraków venture builder ICEO, and two natural persons connected with ICEO entered as beneficial owners; a contact address in the iceo.co domain. Revenue for 2022: 655,875 euros, profit 360,369 euros; for 2023: revenue nil, profit 7,577 euros; for 2024, the year of the credit line, revenue of 1,690,941 euros and a net profit of 4,048,044 euros. According to the register the company has an unfiled annual report, and a notice preceding deletion has been published against it in the official gazette. In April and May of 2025 the exchange sent it 5.75 million ZND as an “external market maker,” with the note that this went through the “ZND Platform (Earn Subscription),” that is, as an entry inside the platform, not on-chain. In the sheets for September 30 and December 31, 2025, there are neither AdmiTrade’s wallets nor its balances. Sixty-six million euros of cover and seventeen million of liabilities vanish between two quarters without a line of comment. Here the books and the sheets close on each other. In the opening balance for 2025, as I wrote in the piece on the loan agreements, the accounts “Admitrade EARN fiat” and “Admitrade EARN crypto” showed 14.4 and 75.0 million euros, 89.5 million in all: the book value of what the sheet calls “Admi wallets” (66.3 million at market prices) and AdmiTrade’s balance (13.7 million). The agreement terminating the credit line, dated July 28, 2025, provided for the return of 58.3 million euros in 245 transfers between July 23 and 26: 6,375 ether, 6.3 million XRP, 9.5 million USDT, 6.7 million USDC, 16,000 SOL, and 12.0 million ZND, with a second batch due by August 7. The sheet for September 30, 2025, shows what was left of that return after two months: 1,323 ether, 3.6 million XRP, 0.29 million USDT, 1.15 million USDC, 9,500 SOL. The assets that came back from the market maker left the exchange’s wallets before the quarter was out, and by April 22, 2026, both AdmiTrade accounts had fallen to zero in the books without a loss being recorded.

Rollman Capital: Twenty-Six Million Tokens Without Payment

The sheet for the third quarter of 2025 keeps a separate tab of movements out of the ZND token’s “Liquidity” pool. Three entries are labelled “Rollman Capital OTC deal”: April 14, 2025, 2,278,942 ZND; April 28, 4,562,044 ZND; May 27, 19,472,527 ZND; 26.3 million tokens in all, valued on the days of dispatch at 2.2 million euros. The description repeats with each: the tokens were sent “based on their commitment agreement to buy tokens for a maximum amount of $20 million,” although “this is not a sale of tokens yet, it is just sending tokens to Rollman for the purpose of a possible sale.” In other words, twenty-six million tokens left the company’s wallets without payment, on account of a transaction that was supposed to follow. The bookkeeper added, in Estonian, the question whether to show this as a receivable, and totalled the tab, together with the transfers to AdmiTrade, as a “Liquidity claim”: 2,754,442 euros. Next to it stands a sentence worth remembering: “For ZND OTC sales we do not know the movement or costs.”

Of Rollman Capital the registers say this much: Rollman Capital S.à r.l., Luxembourg, RCS B271040, registered on September 1, 2022, in Capellen with a capital of 12,000 euros for the management of alternative investment funds, with a dissolution notice and the appointment of a liquidator on April 6, 2023; marked inactive in the Tracxn database. The same group has had a company in Tallinn since 2023, under the Rollman Mining brand. Whether the party to the 2025 agreement was the Luxembourg company, two years into liquidation, or another entity of the group, the sheet does not say. Who stood behind a twenty-million-dollar commitment, whether anything was ever paid, and where the tokens are, are questions whose answers lie in the Luxembourg register and in an agreement of which the sheet quotes only the title. I will add one thing: twenty-six million ZND went to a single recipient in the weeks in which the token’s price fell from 0.10 to 0.08 euros, and by the end of the year to 0.025. A coincidence of timing is not proof; it is a question.

ZND: A Loss Spread Over Three Quarters

The ZND token, issued by the exchange itself, was in the sheets an asset on the company’s side and a liability on the customers’ side. At the end of 2024 the company reported 54.6 million of its own ZND, worth 30.6 million euros; customers held 44.7 million tokens. A year later customers held 158.6 million tokens, three and a half times as many, the company 72.7 million, and the price had fallen from 0.56 euros through 0.34 on September 30 to 0.025 euros on December 31, 2025; I wrote in July about the manipulation of that price and about how Zondacrypto’s customers lost their money. A token that at its peak cost more than a dollar cost two and a half euro cents at the end of 2025, and the company’s own ZND, worth 30.6 million euros a year earlier, were worth 1.8 million; the token treasury held 35.0 million ZND valued at 880,000 euros. Where the threefold growth of customer balances in a token whose price fell twentyfold came from, the sheets do not explain; the staking and rewards program paid out in ZND, whose mechanics I described in the piece on how ZND minted money from nothing, is the simplest candidate, and every token so created became a liability of the company, covered with the thing the company itself was issuing.

The third-quarter sheet also betrays how the loss on the company’s own token was booked. Next to the valuation of the company’s ZND at 9.49 million euros stands the figure 19.26 million, a difference of 9.77 million, and the note “We split loss in 3 quarters,” 3.26 million per quarter. No accounting standard I know allows a revaluation loss to be spread over three quarters; a loss is when it is. A column further on sets the crypto assets from the wallets, 492.1 million euros, against a figure of 544.4 million, a difference of 52.3 million, and against a figure of 551.5 million, a difference of 59.3 million; the sheet does not label where those figures come from, and the simplest reading is book value against wallet value. I mark that as a hypothesis. If it is right, the books as of September 30, 2025, showed fifty-two to fifty-nine million euros more in crypto assets than lay in the wallets, before any question about the address from the Riviera.

Covering liabilities with one’s own token is like paying a debt with one’s own promissory note: it works exactly as long as the creditor does not try to cash it.

The Token Treasury on ICEO’s Slack

The ZND token had a treasury of its own in Fireblocks, apart from the exchange’s vaults, with compartments named as in a prospectus: Seed Sale, Private Sale, KOL’s Round, Public Sale stages one to four, Launchpads, Partners, Treasury, Liquidity, Marketing, Team, Ecosystem Incentives, Owner, Central platform, Special account, Uniswap pool. On January 1, 2025, the sale compartments were empty, and the whole treasury held 18.3 million ZND, 14.2 million of them in “Liquidity.” On top of this, the sheet for the auditor counted among the company’s wallets 23.0 million ZND locked in the staking contract; whose tokens lay in it, customers’ or the company’s, the sheet does not distinguish, counting all of it as the exchange’s property.

The export of transactions from December of 2024 shows how this treasury worked. On December 3, 5.7 million ZND left the Ecosystem Incentives, Marketing, and Public Sale compartments for an external address described as a technical account; on December 18 a further 1.2 million followed, with the note “distribution purposes”; 6.9 million tokens in all. On December 18, 3.0 million ZND came in from the exchange’s hot wallet, the same one that served customer deposits, into the token treasury’s “Central platform” compartment, and the next day 1.18 million went from there to the staking contract; that transaction, alone in the export, carries the chief executive’s second signature. Between December 6 and 19 tokens circulated between the staking contract and the compartments: 2.0 million into staking, 4.0 million out of staking into “Liquidity,” half a million each to Marketing and Public Sale. The transactions were initiated by one person and approved with a second signature by others; the notes attached to them link to a channel in the Slack workspace iceo.slack.com. AdmiTrade was formerly named ICEO CAPITAL EST-1 OÜ and has an address in the iceo.co domain. Who, then, managed the exchange’s token, the exchange or ICEO, and on what basis tokens flowed between the exchange’s hot wallet, the token treasury, and the staking contract, is another question for the trustee, the more pressing because the token treasury lay outside the reconciliation of customer wallets.

Where the Assets Were, and Where They Were Not

The statement for the auditor as of December 31, 2024, has five columns: Fireblocks, BitGo, Sygnum, Seba/Amina, and “Other.” The columns of the two Swiss crypto banks are empty; what the accounts say about the Swiss investment of Zonda I described in April. Fireblocks, the system in which the exchange actually worked, held about 140 million euros in cryptocurrencies; BitGo about 15 million: 59.9 bitcoin, 3.27 million XRP, 9.33 million XLM, and 746 BCH. The “Other” column, with no custodian named and no address given, held about 425 million euros, of which 405 million is the address from the Riviera, the rest being 7.99 million XRP, 4,001 BCH, and 170 ether. A separate tab, “Own funds,” meaning the company’s own property, knows a single line: 40,000 LTC, also under “Other,” worth 3.9 million euros. In other words, seventy-three per cent of what the company showed the auditor as its wallets sat with none of its custodians, and ninety-five per cent of that part was a single address.

The Fireblocks export specifies what the exchange was, technically. On January 1, 2025, the production workspace had 227,496 deposit vaults, one per user, across 192 assets; 62,968 of them held small, unswept deposits, among them 597 ether. The oldest entries date from March of 2021. That answers a question posed above: in the summer of 2021, when the last publicly visible operating wallet of BitBay fell silent, the exchange moved its breathing into Fireblocks vaults. There was no bitcoin in those vaults: 0.000012 BTC, the two permanent addresses of the “COLD” vault empty, not a single deposit vault holding bitcoin. Nor was there any XRP in Fireblocks, though the “COLD” vault had an XRP address. Customers’ bitcoin and XRP were handled by BitGo, and what BitGo did not have sat in the “Other” column. The 7.99 million XRP in that column are about sixteen million euros outside both custodians; whether that is the Zonda XRP wallet that woke up on August 22 with a transfer to a Revolut deposit address can be checked on-chain, by comparing the balance on December 31, 2024.

Finally, the small things, which speak to the quality of the work behind what was shown to the auditor. In the SOL total the statement counted 4,721 units of USDC on Solana as if they were SOL; in the TRX total, 2.14 million USDT on Tron as if they were TRX. Twenty-three million ZND in staking were counted as a company wallet. The 2025 sheets have broken references and a “Check” tab that checks nothing. Someone working carefully with real numbers errs in the third decimal place. Someone working with numbers that have to agree errs in the units.

What Must Be Examined Before Anyone Believes Again

This piece does not close the investigation; it points to where the investigation lies. The list is short, and every item on it can be done in weeks, not years.

1. Proof of control. The trustee should demand that the board member who certified full access before a notary sign a message with the key to the address 16aEn4p6, or make a small transfer to a designated address. A signature proves access to the key at the moment of the test, not legal title to the coins; but access, “full and exclusive,” is precisely what the management certified. A signature would show present control, which is what the declaration claimed; a refusal or a failure would put on the record the question of what the declaration of June, 2025, rested on, for the prosecutors of two countries to answer. The third answer, “it can’t be done,” is an answer. There is also a test that requires no one’s cooperation: the address is of the P2PKH type and held its coins before the chain split of August, 2017, so the same key received 4,503 Bitcoin Cash at that time and, in October, as many Bitcoin Gold. If they lie untouched, no one has used this key even to collect the several million euros lying within arm’s reach; if they were moved, it is known when and where.
2. The label. The analytics firms with commercial databases, Chainalysis, Elliptic, TRM Labs, may hold attributions for the hub 1MmkA1u and the cluster [033a676d6f], and so for the source of the bitcoins that reached the address 16aEn4p6 in March of 2016; the right request is for the label, its basis, and its confidence. If the attribution is BitBay, the loss of the reserve dates from 2016 and the question becomes who knew. If it is anyone else, the question becomes whose coins were on the balance sheet, and since when. I have been asking publicly for that answer since April.
3. BitBay’s flows, 2016 to 2022. The BitBay.net cluster and the operating wallets shown above are public. They show gross flows through the addresses clustered to the exchange; reconciled with the internal ledger, they would show how much customers deposited, how much they withdrew, and where the surpluses went, if there were any. The exchange’s reserve, if it existed, left a trace; if it did not exist, the trace was left by its absence.
4. The books of BitBay sp. z o.o. Thirty million złoty of “other financial costs” in 2017 and a hundred and three million in loans and receivables from “other entities” in 2018 have recipients. The statements do not name them; bank records do.
5. September, 2022. The last operating wallet visible in the public database stops its regular traffic on July 30, 2021, and shows two final transactions on September 7, 2022, in the half-year to which the trustee dates permanent insolvency. The trustee should establish where the infrastructure was moved and who had access to it.
6. AdmiTrade’s wallets. The 66 million euros in cryptocurrencies added on December 31, 2024, to the company’s own funds belonged formally to AdmiTrade OÜ, a company with 2,500 euros of capital at the exchange’s address. The trustee should establish whose funds they were, on what basis they were counted toward the cover of customer balances, and where they are today.
7. Custody exports. Fireblocks and BitGo keep a complete history of their vaults. An export as of the date of the bankruptcy order, set against the 2025 sheets, will show how the wallets melted away between December of 2025 and April of 2026, and who approved the withdrawals.
8. Rollman Capital and the OTC sales of the token. The agreement under which 26.3 million ZND were sent in April and May of 2025 belongs in the file together with its settlement: what was paid, what came back, where the tokens are. The same goes for the OTC sales of the company’s own token, of which the bookkeeper wrote that she knew neither the movement nor the costs.
9. The token treasury. Fireblocks keeps the list of persons with signing rights in the ZND token workspace and the history of every transaction. The trustee should establish who held those rights, who granted them, and on what basis tokens flowed between the exchange’s hot wallet, the token treasury, and the staking contract.
10. The ether trail, 2021 to 2024. The wallet addresses in the certificate of June, 2021, and the Fireblocks vault addresses in the export are known; comparing their on-chain histories will show how much of the 51,600 ETH of the end of 2020 reached the new custody in 2021, and how much went elsewhere, and where. It is the easiest item on this list to carry out, and the only one that dates the largest gap after bitcoin.

Coda

Bitcoin has one property that makes it the worst possible place to keep an alibi: it remembers. The address 16aEn4p6 remembers two deposits from March of 2016, forty further specks of dust, and not one spend. BitBay’s wallets remember seven years of customer deposits and withdrawals, of top-ups by 50, 100, and 150 bitcoins, of payouts to Russia’s BTC-e, to LocalBitcoins, and to Bitcurex in Łódź, and they remember that none of those streams ever passed through the address the chief executive displayed. The books of the Katowice company remember a profit that disappeared in a single row and cash that turned into loans to no one. The company’s spreadsheets remember that, quarter after quarter, everything drained away except one line. All of it is public, all of it verifiable, and all of it was available in each of the ten years in which believing was enough.

The declaration from the Riviera does not prove that the company holds the key. It proves that the chief executive knew what this address looks like in an explorer, and judged that a chart of a flat line would do as evidence of wealth. For as long as the record goes back, it did. It sufficed for the auditor, for the bookkeeper, for the notary, and for a management that issued its own quarterly statements to itself. It will not suffice for the trustee, because the trustee has what none of them used: the power to compel an answer. And it will not suffice for the chain, which has been answering the question of spending the same way for ten years, with one horizontal line. Notarized.

The firm’s other pieces on this case are gathered on the page Zonda (Zondacrypto): the collapse, the bankruptcy and legal help for customers; information for affected customers, including the deadline for lodging claims with the trustee, is in Zondacrypto: legal help for customers.

Corrections to the First Two Pieces

Re-reading the raw chain data and the WalletExplorer database while working on this piece, and again in the course of an independent verification, showed a number of figures and formulations in the April and May, 2026, pieces that need correcting. They do not change the thesis of either; I list them so that the series is consistent.

1. The aggregation cluster [033a676d6f50f05c] was active from January 15 to March 5, 2016, for fifty-one days, not from January 29 for thirty-seven days, and it took in 122 deposits totalling 5,497.82 BTC from 86 addresses, not 76 deposits of about 4,975 BTC from at least 94 addresses. The figure of 4,975 BTC is the cluster’s balance after the outflows of January 20, February 8, and the first of March 6, not the sum of its inflows.
2. The consolidation of March 6, 2016 (txid 4d1a1058…) had 106 inputs from 76 addresses and two outputs, not 94 inputs and one output. The cluster was emptied that day in three transactions, not one or two: 434.45 BTC at 06:30 UTC, then, at 08:03 UTC, 4,434 BTC to 16aEn4p6 and 541.27 BTC to a third wallet.
3. The times in the May piece were given in United States Eastern Time. In Universal Time the hub transactions of February 1, 2016, are at 06:53:23 and 17:31:46, and the deposit of 69.2586 BTC of March 15, 2016, is at 21:29:26.
4. The amounts of 750.146 BTC and 65.054 BTC in the May piece’s hub table are the hub’s input contributions, not the amounts transferred. The 06:53 UTC transaction paid 1,000 BTC to an address in the cluster labelled BTC-e.com, and the 17:31 UTC transaction paid 180.568 BTC to an address of the aggregation cluster; all four inputs of the latter belong to the hub’s wallet.
5. The deposit of 69.2586 BTC is not isolated: it came from wallet [89547e98ce46121f], which had itself sent nine of the 122 inflows into the aggregation cluster and had paid an address labelled BTC-e.com.
6. The BTC-e.com label on the address 1EwpC13X… is an attribution by the WalletExplorer database, not a fact of the ledger; I maintain the trail and change its status. The United States Department of Justice describes Alexander Vinnik as one of BTC-e’s operators, not its founder, and puts the exchange’s throughput at more than nine billion dollars.
7. The state of the address on September 12, 2026: 42 unspent outputs and 4,503.25950922 BTC; from the video of April 16 to May 26, 2026, nine dust receipts arrived, the largest of 30,000 satoshi. Spends: still zero.
8. The hypothesis of April and May that the key was lost in 2016 remains one of three of equal standing, alongside a wallet that was never the company’s and an over-the-counter purchase settled to a key held by one person. In May I named it the most probable; today I do not rank them, because only the books of 2016 and 2017 can.

Annex: On-Chain Material for Independent Verification

The transaction and address links below lead to public ledger data, which no one can alter. The WalletExplorer links show a third party’s clustering and labels, heuristic and revisable, and are not part of the ledger.

A. The Address Displayed by the Chief Executive

Address: 16aEn4p6hK4FMpLtJGpoQZMZ946sDg1Z6n, type P2PKH.

1. Balance in the declaration of June 26, 2025 (“as of 31.12.2024”): 4,503.25874912 BTC in 28 UTXOs; as of September 12, 2026, the balance is 4,503.25950922 BTC in 42 UTXOs, a further 76,010 satoshi of dust having arrived since.
2. Total received equals balance: zero outgoing transactions since March 6, 2016.
3. Last inflow visible on the screenshot attached to the declaration: December 29, 2024, 12:08 UTC, 547 satoshi, txid 34c8ab…975630.
4. Parallel explorers: Blockchain.com, Blockchair; BitInfoCharts dormant-address rankings: eight years, ten years.

B. The Two Deposits of March, 2016

The source of the second deposit is wallet [89547e98ce46121f] (four addresses, 582 transactions to September of 2016), the same wallet that sent nine of the 122 inflows into the aggregation cluster and that paid, in April of 2016, an address WalletExplorer labels BTC-e.com. Both material deposits therefore share an upstream counterparty.

C. The Aggregation Cluster [033a676d6f50f05c] and the Hub

1. Cluster active from January 15 to March 5, 2016: 122 incoming transactions from 0.75 to 180.57 BTC, about 5,498 BTC gross; outgoing payments on January 20 and February 8 (87.9 BTC in all); emptied on March 6, 2016, in three transactions (txids 4165836e…, 4d1a1058…, d251f636…): 434.45 BTC at 06:30:47 UTC, then, at 08:03:46 UTC in a single block, 4,434 BTC to 16aEn4p6 and 541.27 BTC, each with a small change output; inflows less outflows and fees reconcile to zero.
2. Hub 1MmkA1uaH3r5iut1wr1vymqjasCvHN5pD2, February 1, 2016: 06:53:23 UTC, a transaction (txid 53a3bccd…) paying 1,000 BTC to an address in the BTC-e.com cluster, 750.1462 BTC of it from three UTXOs at the hub and the rest from six addresses of its cluster; 17:31:46 UTC, a transaction (txid acd7b553…) of four inputs, all from the hub’s wallet, including 65.054 BTC from the hub address itself, paying 180.568 BTC to an address of the aggregation cluster and 1.506 BTC to a second output that appears to be change.
3. None of the cluster’s inputs or sources carries the BitBay.net label in WalletExplorer.

D. BitBay’s Wallets in WalletExplorer

None of these wallets received funds from the address 16aEn4p6 (the address has never sent anything), and none is a source of its funds according to the public clustering of addresses.

E. The Wallet Reconciliation Sheets “Balances x Wallets”

Working documents of the management: as of December 31, 2024, in a version marked “for auditors”; as of September 30 and December 31, 2025, for the bookkeeper. Prices as given in the sheets; the value of the address 16aEn4p6 and the assets without it are the author’s arithmetic. As of December 31, 2024, the wallet side includes “Admi wallets” worth 66.3 million euros; without them the wallets came to 584.0 million euros. Fireblocks vault export as of January 1, 2025, 00:00 Polish time: 0.000012 BTC; BitGo holdings at the same moment: 59.9 BTC.

F. ZND Transfers Out of the “Liquidity” Pool in 2025, per the Tab in the Third-Quarter Sheet

G. Company Wallets and Customer Balances, December 31, 2024, Against December 31, 2025

Data from the “Balances x Wallets” sheets; the wallet side as of December 31, 2024, includes the “Admi wallets” (ETH 10,200, XRP 9.1 million, USDT 8.4 million, USDC 2.8 million).

H. The Reserve Certificate of June 18, 2021 (as of December 31, 2020), Against the Sheets

Balances from the certificate as read from the scans (Funds Monitor, BitGo, Etherscan); “unreadable” marks a chart value the scan does not allow to be read. The 2024 column follows the sheet for December 31, 2024, own custody with the “Admi wallets” shown separately; the 2025 column follows the sheet for December 31, 2025.

All cited addresses and transactions can be verified in public blockchain explorers. The on-chain analysis is based entirely on public data. We welcome dispute.

Legal and factual state as of September 12, 2026. Documents from the Estonian bankruptcy file are described according to their contents; the interim trustee’s findings are assessments at a preliminary stage of the proceedings, not rulings of the court; the declaration of June 26, 2025, is a statement by the management whose contents the notary did not examine. The grouping of addresses in WalletExplorer relies on the common-spending heuristic and may contain errors; the attribution of the operating wallets to BitBay follows from the flows described in the text, not from any statement by the company. The reserve certificate of June 18, 2021, the wallet reconciliation sheets (“Balances x Wallets”), and the exports from the custody systems are described according to their contents; they are working documents of the company that have not been independently verified, and the coverage figures without the address 16aEn4p6 are the author’s arithmetic on that basis. The registry data on AdmiTrade OÜ are given as they appear in the Estonian commercial register on September 12, 2026. Information on Rollman Capital and on ICEO comes from public databases and company profiles and has not been confirmed in registers; neither of those entities, nor anyone connected with them, is, to my knowledge, a party to any proceedings in this matter. I give no employees’ names; the descriptions of transactions in the token treasury come from the custody system’s export and refer to roles, not persons. Calculations marked as arithmetic and assessments marked as hypotheses remain arithmetic and hypotheses. Charges in the criminal investigation are not findings of a court; all persons named enjoy the presumption of innocence.

Robert Nogacki

Robert Nogacki – licensed legal counsel (radca prawny, WA-9026), Founder of Kancelaria Prawna Skarbiec.

There are lawyers who practice law. And there are those who deal with problems for which the law has no ready answer. For over twenty years, Kancelaria Skarbiec has worked at the intersection of tax law, corporate structures, and the deeply human reluctance to give the state more than the state is owed. We advise entrepreneurs from over a dozen countries – from those on the Forbes list to those whose bank account was just seized by the tax authority and who do not know what to do tomorrow morning.

One of the most frequently cited experts on tax law in Polish media – he writes for Rzeczpospolita, Dziennik Gazeta Prawna, and Parkiet not because it looks good on a résumé, but because certain things cannot be explained in a court filing and someone needs to say them out loud. Author of AI Decoding Satoshi Nakamoto: Artificial Intelligence on the Trail of Bitcoin’s Creator. Co-author of the award-winning book Bezpieczeństwo współczesnej firmy (Security of a Modern Company).

Kancelaria Skarbiec holds top positions in the tax law firm rankings of Dziennik Gazeta Prawna. Four-time winner of the European Medal, recipient of the title International Tax Planning Law Firm of the Year in Poland.

He specializes in tax disputes with fiscal authorities, international tax planning, crypto-asset regulation, and asset protection. Since 2006, he has led the WGI case – one of the longest-running criminal proceedings in the history of the Polish financial market – because there are things you do not leave half-done, even if they take two decades. He believes the law is too serious to be treated only seriously – and that the best legal advice is the kind that ensures the client never has to stand before a court.