Zonda: EUR 501k to the CEO, EUR 118k to Lake Constance, EUR 230k to Łódź. The Last Month Before Withdrawals Stopped

In March 2026, the last month before withdrawals were frozen, EUR 2.63 million left the euro bank accounts of the zondacrypto exchange for external recipients: excluding transfers between the company’s own accounts, currency exchanges, stablecoin purchases and bank fees, but including payment operators, taxes and salaries; transfer amounts are given net of the operators’ fees. Three recipients were paid day after day, while customers were being advised to split their withdrawals into smaller ones and wait for “full stabilisation of the system”.

Przemysław Kral, CEO and beneficial owner of BB Trade Estonia OÜ, received fourteen transfers between 2 and 24 March totalling EUR 501,037.80; each is covered by a sale of USDC that had left the exchange’s hot wallet for the bank that same morning. A person who gave the payment operator a hotel in Arbon, on Lake Constance, as their address received eleven transfers totalling EUR 117,637.33, including six of exactly EUR 10,000 on five consecutive business days.

A person from Łódź received ten transfers totalling EUR 116,052, and NGNP Digital OÜ, a company in which, according to the Estonian business register, that person is a board member and beneficial owner, received a further EUR 113,436.29 in three transfers, through the same channel the exchange used to pay out its users. Three individuals and one company, EUR 848,000, close to a third of that sum.

In the language of insolvency law, these are transactions to be examined for recovery; in the language of journalism, a company being cleaned out before bankruptcy. Who ordered these payouts, and on what basis, is for the trustee and the prosecutors to establish. Who received them, the bank statements say.

The CEO: fourteen transfers, fourteen sales

The mechanism has three links and repeats in the same sequence: eleven times it closes within a single day, three times the payout arrives the next morning. Early in the morning, usually between six and eight Polish time, a round amount of USDC leaves the exchange’s hot wallet on Ethereum, labelled “Zonda 5” on Etherscan, for the bank: 70,000 on 2 March, then 150,000 the same afternoon. On BB Trade Estonia’s euro account at Sygnum Bank an entry appears, “Sale -70000 USDC”, EUR 59,383.59.

Sygnum passes that amount to the exchange’s account at ZEN.COM, charging its fee separately, and from ZEN the same amount, to the cent, goes out under the description “Przemysław Kral, EE withdrawal pkral1” to an account held at ZEN in his name. The description says what this formally was: a withdrawal from the user account with the login pkral1. In the accounting export these transfers have no separate account; they were treated like other users’ withdrawals. To the ledger, the CEO was one user among many, only served daily.

Amounts in EUR. Source: Sygnum Bank statement (EUR account) and ZEN.COM statement (main EUR account) for March 2026; the hashes of the fourteen USDC transfers from the exchange’s wallet to the bank, on the sale dates and in the same amounts, are in the annex.

Fourteen payouts on thirteen of the seventeen business days, none at the weekend. For scale: according to the exchange’s own reconciliation as at 31 December 2025, wallets against customer balances, which we described alongside the trustee’s report, customers held 49.1 million USDC on the exchange, and the exchange held 0.96 million in its wallets, two percent.

The stablecoins sold to fund the CEO’s payouts left that wallet, which serves the withdrawals of many users, not a separate address; the chain shows it, although an address by itself does not say whose funds flowed through it. The amounts match to the cent in all fourteen cases; in most of them, without the inflow from Sygnum the ZEN account would not have covered that day’s payout, while on four days (4, 5, 6 and 23 March) the balance would have sufficed without it.

Whether his user account pkral1 was backed by funds he had previously deposited is known only to the exchange’s internal customer ledger, which the trustee does not have and which the prosecutors should have on the seized servers, if it could be read. That answer decides which provision applies, not whether there is anything to examine: a genuine claim of the CEO’s does not protect its satisfaction from being reversed in bankruptcy, and a lack of backing turns the matter into a heavier one.

The CEO appears here in two roles, as recipient and as the person running the company’s affairs; who technically approved each of the fourteen payouts, the logs will show, but payouts to this account were executed on thirteen of seventeen business days, in a period when other users were reporting delays of weeks. One qualification is necessary here: the March support messages concerned withdrawals of cryptocurrencies, while the CEO’s payouts went out in euro, after the exchange itself had sold cryptocurrencies.

Whether this was the same queue with a privileged front, or a separate channel with its own rules, a comparison of orders and logs will show; the regularity of the payouts is a fact, the preferential treatment is a hypothesis to be tested.

On 27 March the direction reverses for a day. From a ZEN account held in the name of Przemysław Janusz Kral, with an address in Monaco, EUR 50,000 and EUR 330,000 arrive at the exchange.

Together with the EUR 57,729.10 already sitting on the account, that is enough for two transfers: EUR 105,500 goes to the account from which the exchange pays invoices, and a transfer described as VAT, EUR 105,410.79 plus a fee of 105.41, leaves it for the Estonian Tax and Customs Board; EUR 330,000 reaches Sygnum, with EUR 150 of ZEN’s fee on the way, and 375,269.93 USDC are bought there for EUR 327,189.49.

At 3:17 p.m. Polish time those stablecoins land in the exchange’s hot wallet, which at that moment held 9,405.46 USDC. Between 3:25 and 3:40 p.m., four payouts totalling 93,630.84 USDC leave the wallet, and at 3:46 p.m. a transfer of 291,000 USDC goes to an address from which, seven minutes later, the funds move on to a wallet labelled on Etherscan as Kraken Hot Wallet 4. When it is over, 44.55 USDC remain in the wallet.

Without the top-up from the purchase the CEO paid for that day, the wallet’s balance would not have covered the whole sequence, nor the 291,000 USDC transfer on its own; at least 281,594 USDC of that transfer had to come from the new inflow.

The month’s balance on the CEO’s side: EUR 501,000 taken out in fourteen transfers, EUR 380,000 paid in on a single day into an account from which, that same day, the company’s tax and the stablecoin purchase were paid; of the 375,000 USDC bought, 291,000 went within half an hour to a deposit address at another exchange.

The difference between the two series is EUR 121,000; that is a net of flows between two accounts, not a settlement between the CEO and the company, and not an amount that automatically reduces any claim for restitution, because nobody has done that settlement yet.

Why, three days after the last of the fourteen payouts, new deposits arrived from the CEO’s account and turned that same day into stablecoins sent to another exchange, no document explains; nor do the documents identify who ordered either sequence or what its business purpose was, and that is the first question the trustee should put to the board. On 6 March, support was writing that larger withdrawals required manual release after full stabilisation of the system. The CEO’s withdrawals, including EUR 127,486.36 on 3 March, did not wait for stabilisation.

Lake Constance

The second name on the list belongs to an individual who gave ZEN a hotel in Arbon, a small Swiss town on Lake Constance, as their address. The address matters here for supervisory reasons, not scenic ones: it is an element of recipient verification, and what status it had in the KYC file, or whether it matched the recipient’s actual whereabouts, we have not established.

The recipient’s account is held with the same operator as the CEO’s, ZEN; the money did not go to a Swiss bank, Switzerland is in the address. The recipient received eleven transfers from the exchange’s main account totalling EUR 117,637.33: EUR 2,000 on 5 March, EUR 37,181.54 on 6 March, EUR 4,529.72 and EUR 9,990.01 on 17 March, EUR 10,000 each on 18, 19 and 20 March, twice EUR 10,000 on 23 March, EUR 10,000 and EUR 3,936.06 on 24 March.

The transfers carry system references, like all customer withdrawals, so formally these were withdrawals from a user account. Six equal amounts of EUR 10,000 may reflect a limit per instruction or the splitting of a larger sum; the two payouts on 23 March and the earlier EUR 37,181.54 rule out a simple daily limit. The rules on limits and the order history are known only to the exchange’s system.

Who the recipient is, the statement does not say; a hotel address does not even say where they live. This much is known: on the days when customers were receiving yet more assurances of “maximum operational pressure”, a person with a hotel address in Arbon was receiving EUR 10,000 every business day, and on 6 March, the day support was advising customers to split larger withdrawals into parts, EUR 37,181.54.

Whether this was a customer who was simply paid on time, or someone from the exchange’s circle, will be settled by the KYC file for that account and its order history: with the trustee, if he has recovered them, and if not, on the servers seized by the prosecutors. That is the first question to be asked about this account.

Łódź

The third name is a person from Łódź: ten transfers totalling EUR 116,052 (debits to the exchange’s account including the operator’s fees: EUR 116,168.05), eight of between EUR 5,000 and 6,001 between 2 and 20 March, EUR 23,000 on 23 March and EUR 50,000 on 30 March, the day support was telling customers that every withdrawal was being processed manually. The odd endings visible on the statement, 5,005 or 50,050, are the operator’s fee added to round transfers; the statement splits each entry into transfer and fee.

The same person sits on the governing body of one of the month’s largest corporate recipients. NGNP Digital OÜ, a company with an address at Lõõtsa tn 5 in Tallinn, received transfers of EUR 26,000, 35,000 and 52,436.29 on 19, 23 and 25 March, into an account at a Belgian bank, EUR 113,436.29 in all (EUR 113,549.73 including the operator’s fees).

The transfer descriptions name no invoice and no service; they carry system references in the format used for user withdrawals, which is consistent with the withdrawal of an account balance on the exchange, not with payment for a service. According to the Estonian business register (code 14511495), the company’s board and beneficial owners are three Polish nationals.

In its annual report for 2025, filed with the register on 24 April 2026, the company declares that it invests exclusively its own capital in virtual currencies using a proprietary algorithm, and shows EUR 269,000 of virtual currencies at the end of 2025 against EUR 426,000 a year earlier. That fits an account holder on the exchange withdrawing a balance; the report does not say, however, whether that balance sat on Zonda, whether it was fully backed, or why it was executed while others waited.

The individual and the company that, according to the register, this person co-controls received EUR 229,488.29 in four weeks, including EUR 50,000 on 30 March and EUR 52,436.29 on 25 March, in the last week before payouts stopped. Two separate recipients, connected to each other rather than to the debtor, and one question: were these two customers’ balances paid out on time, or something more.

The same KYC files and the histories of both accounts will settle it; the order of checking is obvious: first those who were paid every day while others were not paid at all.

What customers were being told at the time

At the same time, Zonda’s customers were standing in the queue and waiting politely. Support’s replies were templates: the same sentences went to different people on different days, sometimes under different signatures.

On 6 March at 5:03 p.m., support wrote, unprompted, that the “technical operator” had a problem with larger withdrawals in all cryptocurrencies, that smaller ones were going through as standard while larger ones required manual release “after full stabilisation of the system”, and advised cancelling a larger withdrawal and splitting it into withdrawals of 1 BTC each; that day the CEO received EUR 11,140.53 and the person from Arbon EUR 37,181.54.

On 10 March it promised “priority treatment” and “maximum operational pressure”; that day the CEO received EUR 25,835.68 in two transfers.

On 20 March it explained that “withdrawals are processed in the order in which the instructions were received” and that “cancelling and resubmitting does not speed up execution”; that day the person from Arbon received EUR 10,000 for the third day running. On 30 March, in a chat: “all withdrawals are processed manually by us, hence the extended waiting time”; that day the person from Łódź received EUR 50,050.

On 31 March: a failure of the automatic funding of the operational wallet, funds “are being collected manually from deposit addresses”, the queue lengthened by the “geopolitical situation” and a “sharp increase in the number of orders”, but “the funds are completely safe”; that day the card gateway took in EUR 58,000 of fresh deposits. We wrote about that 31 March email in April.

Every ticket triggered an automatic warning: “every new message moves your thread to the end of the queue, which will extend the waiting time”. Agents’ signatures changed from one message to the next, with no continuity, and a message of 2 April signed with a man’s name contains verbs in the feminine form; it looks as if the text was pasted from a template and the signature chosen separately.

Glitches on the way in were fixed within hours, deposits of ZND tokens were credited within two hours of being reported, and withdrawals waited for weeks. Some waited weeks for cryptocurrency withdrawals, others received euro every day; whether that was one queue with two ends or two channels with different rules, orders and logs will settle. One thing is certain: every question about a withdrawal moved the customer’s thread to the back of a second queue, the one for support.

A customer who, in the first days of April, looked into the blockchain himself was right on the facts: USDC transfers from the exchange’s addresses were going out, larger withdrawals were being executed, his own orders stood still. He could not have known that among those transfers were the daily morning transfers to the bank that funded the CEO’s payouts. Confronted with an accurate diagnosis, support replied on a Sunday that its departments worked only on business days.

Where the euro came from, and what happened to the USDC

About EUR 2.4 million arrived from outside on the euro accounts in March, not counting złoty deposits, currency exchanges and the exchange’s own sales of cryptocurrencies, and it arrived at a company that its own trustee considers to have been permanently insolvent since the end of 2022. Deposit settlements were booked without interruption to the end of the month; the faults were mainly at the exit doors.

The largest stream was the ZEN payment gateway: 1,902 settlements of customer payments by card and app totalling EUR 1,109,228.54, median EUR 100, booked on all 31 days of March and swept regularly into the main account (26 transfers on 19 days). The payment operator ZEN.COM UAB transferred six round amounts totalling EUR 420,000 of unexplained nature, the CEO EUR 380,000.

With those euro the exchange bought 1,009,409.91 USDC at Sygnum for EUR 879,452.46, in nine purchases between 6 and 27 March. All nine amounts arrived the same day in the “Zonda 5” hot wallet, to six decimal places; the stablecoins did not vanish in the bank, they returned to the exchange and left from there.

In March, 5.06 million USDC left that wallet, of which 1.87 million, 37 percent, went to a single address that forwards to a wallet labelled as Kraken, the same address that on 27 March took the 291,000 USDC from the purchase the CEO had paid for, and 0.65 million went to three addresses labelled as Binance deposit addresses. Recoveris described in April 511 transfers from the exchange’s wallets to that Kraken address between mid-December and 2 April, worth about USD 21 million.

Who held the account on which Kraken credited those deposits, only Kraken knows, and that is a question the trustee and the prosecutors can put to it with a specific hash, instead of asking in general where the cryptocurrencies went. The chain by itself will not reveal the holder of the Kraken account; it showed what it had to show: where the stablecoins sold to fund the CEO’s payouts were taken from, and what happened to the wallet into which the top-up from his deposit landed.

The background is in the income statement for the sixteen months to 22 April, the last one the bookkeeper prepared: EUR 6.6 million in commission revenue, EUR 4.0 million in costs of advertising, listings and partner commissions, EUR 2.1 million on advisory services with no names in the ledger, EUR 2.7 million in Orion’s IT invoices and EUR 1.7 million in VAT the company could not deduct.

An income statement does not show the state of the till, but it shows the proportions: the exchange earned EUR 6.6 million in commissions and booked EUR 4 million in advertising, listing and commission costs, advertising a company that, according to its own trustee, had by then been insolvent for three years.

What follows: § 113 of the Estonian act and Article 302 of the Polish Criminal Code

The Estonian Bankruptcy Act (Pankrotiseadus) governs the recovery of the debtor’s pre-bankruptcy transactions in § 109 and the provisions that follow. March fits § 113(1)(3) above all: the court revokes the performance of a financial obligation to a person connected with the debtor, made within two years before the appointment of the interim trustee, unless that person or the debtor proves that the debtor was solvent at the time of the payment and did not become insolvent as a result of it.

The interim trustee was appointed on 27 July 2026; the CEO’s fourteen transfers fall inside that window with room to spare, and a member of the management board is a connected person by virtue of § 117. The trustee must show the payment, the period, the connection and harm to creditors’ interests, as the general § 109 requires; on that last element he has his own finding of permanent insolvency since the end of 2022, although the court will examine the company’s position on the dates of the individual payouts.

The main field of defence is the proof of solvency, even if the defendant also contests the other elements, and that is the crux: a genuine claim of the CEO’s does not protect its satisfaction from reversal; what protects it is proof that the company was solvent at the time and was not rendered insolvent by the payment, and that proof rests with him. The EUR 380,000 deposit does not automatically reduce such a claim; the consequences of recovery are governed separately by § 119.

This is a mechanism of insolvency law, not a reversal of the burden of proof in a criminal case. As regards the other recipients, § 113(1)(2) reaches back three months before the appointment of the interim trustee, that is to late April, and does not cover March transfers; § 110 concerns the recovery of legal transactions rather than the performance of an obligation, with its own periods and its own requirements as to the other party’s knowledge.

For the recipients from Arbon and Łódź, establishing a connection with the company within the meaning of § 117, which also allows the court to treat as connected other persons sharing a substantial economic interest with the debtor, is therefore decisive for the two-year period of § 113; other grounds would require examining the basis and nature of the transaction itself. The answer lies in the KYC files of both accounts and in the contracts, if there were any.

On the Polish side, in the investigation that already covers the exchange’s operations, the qualification the prosecutors have applied in this case, in the charge against the president of the Polish Olympic Committee (in Polish), is Article 302 § 1 of the Criminal Code (Kodeks karny): paying off only some creditors when insolvency is looming, to the detriment of the others, in conjunction with Article 308, which extends that liability to a person managing the debtor’s financial affairs.

There it concerned inducing selective payouts in April; here it concerns fourteen payouts in March to a person who knew the state of the company best, because the management balance sheet as at 31 December 2025, printed on 5 March, showed him EUR 3 million in cash and EUR 343 million in cryptocurrencies sitting at an address to which, as he announced in April, there was no key.

The elements of that provision are more than a transfer to a board member’s account: the company’s position on the payout dates, other unsatisfied claims, the rules for executing orders and who decided on the payouts; the statements indicate which operations need explaining, and there their role ends. Other qualifications, including Article 300 § 1 of the Criminal Code, depend on establishing title to the funds and who controlled them after they were passed to another exchange, and we do not prejudge that today.

The mere receipt of a payout by the person from Arbon, the person from Łódź or NGNP Digital OÜ decides nobody’s liability. These are the legal assessments of counsel for the victims; to our knowledge, no one has been charged in connection with the March transfers described here, and everyone named enjoys the presumption of innocence. The whole difficulty of this case, until now, was that the books contained no names. The statements do, and that is where the work begins, not where it ends.

Facts and law as at 15 September 2026. The bank statements for March 2026 are company documents held in the file of the bankruptcy proceedings of BB Trade Estonia OÜ before Harju County Court (Harju Maakohus); amounts have been rounded, transfer amounts are given net of payment operators’ fees (the debits to the company’s accounts are EUR 1,159.38 higher in total), and neither account numbers nor the full details of natural persons other than board members are given. On-chain data concern the USDC contract on Ethereum and the wallet labelled Zonda 5 on Etherscan; address labels are the explorer’s attributions, not proof of ownership, and transaction hashes are in the annex below. Estonian business register data as at 15 September 2026. Quotations from customer support are the exchange’s templated communications of March and April 2026, recurring in the correspondence of many victims; we attribute them to no particular person. The interim trustee’s findings are his assessments at a preliminary stage of the proceedings; the Recoveris findings come from an external report. Legal assessments are those of counsel for the victims; marked hypotheses remain hypotheses. To our knowledge, no one has been charged in connection with the transfers described; everyone named enjoys the presumption of innocence.

Annex: on-chain transactions

The data concern the USDC contract on Ethereum (0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48) and the exchange’s hot wallet labelled “Zonda 5” on Etherscan (0x6edf968da408a9640b8865826429a977a11c5048). The bank’s deposit address on the sale side: 0x1990abd6e49218ab403f01aefeb9d22d07244181; the sender of the purchases: 0x40b5a4ccfc57f43ad6b8fd77c590b7f4174872b3; the intermediary address of the Kraken channel: 0x8d73769a2422f55a9a270fe08b00264ff564696c, forwarding to 0x05ff6964d21e5dae3b1010d5ae0465b3c450f381 (Etherscan label: Kraken Hot Wallet 4). Labels are the explorer’s attributions, not proof of ownership. Export of 14 September 2026; every hash can be opened on Etherscan.

Table A. Fourteen USDC transfers from the exchange wallet to the bank, corresponding to the sales that funded the payouts to the CEO’s account.

Table B. Nine USDC purchases at Sygnum and the same-day inflows into the exchange wallet.

Table C. The sequence of 27 March 2026 in the exchange wallet; balance before the inflow 9,405.46 USDC, after the sequence 44.55 USDC.

Robert Nogacki

Robert Nogacki is a Polish attorney at law (radca prawny), the founder and managing partner of Kancelaria Prawna Skarbiec (Skarbiec Law Firm), which has operated continuously since 2006.

The law is equal for everyone, but the parties rarely are: on one side stands an organization with time, money, and lawyers, on the other a person with one business, one nest egg, and one life.

Clients rarely come to him with a legal problem. They come with a problem that also has a legal side: an audit that began with a single invoice, money entrusted to someone who has disappeared, a company that has to be passed on before it is too late. Most such matters are decided long before the first letter is written, in decisions made without asking and in deadlines nobody remembered. So he begins by asking how the client got here, not what the client should have done.

He advises entrepreneurs and families from more than a dozen countries, including those whose accounts the tax office has just seized and who do not know what to do tomorrow morning. He defends them in tax audits, customs and fiscal inspections, disputes with the tax authorities, and criminal tax proceedings. He represents victims of investment fraud and Ponzi schemes. He helps families set up family foundations and plan succession, so that a life’s work outlasts a single generation.

Not every case can be won. Every case can be run so that the client knows where they stand. Since 2006 he has represented the victims in the WGI case (Warszawska Grupa Inwestycyjna, the Warsaw Investment Group), one of the longest criminal cases in the history of the Polish financial market, because some things must not be left half finished, even when they take two decades. In the case of the collapsed cryptocurrency exchange Zonda (Zondacrypto, operated by BB Trade Estonia OÜ), he represents several hundred victims in the criminal investigation conducted by Poland’s National Prosecutor’s Office and in the Estonian bankruptcy proceedings.

Kancelaria Prawna Skarbiec is listed in the rankings of Poland’s largest tax advisory firms published by Dziennik Gazeta Prawna and Rzeczpospolita, and it is a four-time recipient (2015 to 2018) of the European Medal awarded by the Business Centre Club and the European Economic and Social Committee. Robert Nogacki publishes regularly, in the press and on the firm’s website, for people who have a problem rather than a law degree, because a legal opinion the client cannot understand protects only the lawyer.

He believes that the best legal advice is the kind that means the client never has to appear in court.