Zonda: EUR 501k to the CEO, EUR 118k to Lake Constance, EUR 230k to Łódź. The Last Month Before Withdrawals Stopped

Robert Nogacki, attorney at law (radca prawny), Skarbiec Law Firm · 15 September 2026

In March 2026, the last month before withdrawals were frozen, EUR 2.63 million left the bank accounts of the zondacrypto exchange for external recipients: excluding transfers between the company’s own accounts, stablecoin purchases and bank fees, but including payment operators, taxes and salaries. Three recipients were paid day after day, while customers were being advised to split their withdrawals into smaller ones and wait for “full stabilisation of the system”. Przemysław Kral, CEO and beneficial owner of BB Trade Estonia OÜ, received fourteen transfers between 2 and 24 March totalling EUR 501,037.80; each is covered by a sale of USDC that had left the exchange’s hot wallet for the bank that same morning. A person who gave the payment operator a hotel in Arbon, on Lake Constance, as their address received eleven transfers totalling EUR 117,637.33, including six of exactly EUR 10,000 on five consecutive business days. A person from Łódź received ten transfers totalling EUR 116,168.05, and NGNP Digital OÜ, a company in which, according to the Estonian business register, that person is a board member and beneficial owner, received a further EUR 113,549.73 in three transfers, through the same channel the exchange used to pay out its users. Three individuals and one company, EUR 848,000, close to a third of everything that left the company’s accounts in March. In the language of insolvency law, these are transactions to be examined for recovery; in the language of journalism, a company being cleaned out before bankruptcy. Who ordered these payouts, and on what basis, is for the trustee and the prosecutors to establish. Who received them, the bank statements say.

The CEO: fourteen transfers, fourteen sales

The mechanism has three links and repeats in the same sequence: eleven times it closes within a single day, three times the payout arrives the next morning. Early in the morning, usually between six and eight Polish time, a round amount of USDC leaves the exchange’s hot wallet on Ethereum, labelled “Zonda 5” on Etherscan, for the bank: 70,000 on 2 March, then 150,000 the same afternoon. On BB Trade Estonia’s euro account at Sygnum Bank an entry appears, “Sale -70000 USDC”, EUR 59,383.59. That amount, plus a fee, leaves Sygnum for the exchange’s account at ZEN.COM, and from ZEN the same amount, to the cent, goes out under the description “Przemysław Kral, EE withdrawal pkral1” to an account held at ZEN in his name. The description says what this formally was: a withdrawal from the user account with the login pkral1. The bookkeeper recorded these transfers exactly like other customers’ withdrawals, with no separate account; to the ledger, the CEO was one user among many, only served daily.

Fourteen payouts on thirteen of the seventeen business days, none at the weekend. For scale: according to the exchange’s own reconciliation as at 31 December 2025, wallets against customer balances, which we described alongside the trustee’s report, customers held 49.1 million USDC on the exchange, and the exchange held 0.96 million in its wallets, two percent. The stablecoins sold to fund the CEO’s payouts left that shared wallet, not any separate address in his name; the chain shows it and there is no need to assume it. Whether his user account pkral1 was backed by funds he had previously deposited is known only to the exchange’s internal customer ledger, which the trustee does not have and which the prosecutors should have on the seized servers, if it could be read. That answer decides which provision applies, not whether there is anything to examine: a genuine claim of the CEO’s does not protect its satisfaction from being reversed in bankruptcy, and a lack of backing turns the matter into a heavier one. The CEO appears here in two roles, as recipient and as the person running the company’s affairs; who technically approved each of the fourteen payouts, the logs will show, but account pkral1 stood in the same queue as every other user’s, and on thirteen of seventeen business days it stood at the front of it.

On 27 March the direction reverses for a day. From a ZEN account held in the name of Przemysław Janusz Kral, with an address in Monaco, EUR 50,000 and EUR 330,000 arrive at the exchange. Together with the EUR 57,729.10 already sitting on the account, that is enough for two transfers: EUR 105,500 goes to the account from which the exchange pays invoices, and EUR 105,516.20 leaves it for the Estonian Tax and Customs Board as VAT; EUR 330,150 goes to Sygnum, where 375,269.93 USDC are bought for EUR 327,189.49. At 3:17 p.m. Polish time those stablecoins land in the exchange’s hot wallet, which at that moment held 9,405.46 USDC. At 3:46 p.m., 291,000 USDC leave the wallet for an address from which, seven minutes later, they move on to a wallet labelled on Etherscan as Kraken Hot Wallet 4; along the way, four smaller payouts totalling 93,630.84 USDC. When it is over, 44.55 USDC remain in the wallet: without the inflow from the purchase the CEO paid for that day, the wallet had nothing to execute any of those five payouts with. The month’s balance on the CEO’s side: EUR 501,000 taken out in fourteen transfers, EUR 380,000 paid in on a single day, of which 105,000 paid the company’s tax and 327,000 turned into stablecoins, three quarters of which went within half an hour to a deposit address at another exchange. The difference between the two series is EUR 121,000; that is a net of flows between two accounts, not a settlement between the CEO and the company, because nobody has done that settlement yet. Why the money first went out in euro and then, three days later, partly came back to go out in another currency to another exchange, no document explains; nor do the documents identify who ordered either sequence or what its business purpose was, and that is the first question the trustee should put to the board. On 6 March, support was writing that larger withdrawals required manual release after full stabilisation of the system. The CEO’s withdrawals, including EUR 127,486.36 on 3 March, did not wait for stabilisation.

Lake Constance

The second name on the list belongs to an individual who gave ZEN a hotel in Arbon, a small Swiss town on Lake Constance, as their address. The address matters here for supervisory reasons, not scenic ones: it is an element of recipient verification, and a hotel is not a place of residence. The recipient received eleven transfers from the exchange’s main account totalling EUR 117,637.33: EUR 2,000 on 5 March, EUR 37,181.54 on 6 March, EUR 4,529.72 and EUR 9,990.01 on 17 March, EUR 10,000 each on 18, 19 and 20 March, twice EUR 10,000 on 23 March, EUR 10,000 and EUR 3,936.06 on 24 March. The transfers carry system references, like all customer withdrawals, so formally these were withdrawals from a user account. Six equal amounts of EUR 10,000 on five consecutive business days look like a daily limit used to the last euro, although two went through on 23 March; the rules on limits and the order history are known only to the exchange’s system.

Who the recipient is, the statement does not say; a hotel address does not even say where they live. This much is known: on the days when customers were receiving yet more assurances of “maximum operational pressure”, a person with a hotel address in Arbon was receiving EUR 10,000 every business day, and on 6 March, the day support was advising customers to split larger withdrawals into parts, EUR 37,181.54. Whether this was a customer who was simply paid on time, or someone from the exchange’s circle, will be settled by the KYC file for that account and its order history: with the trustee, if he has recovered them, and if not, on the servers seized by the prosecutors. That is the first question to be asked about this account.

Łódź

The third name is a person from Łódź: ten transfers totalling EUR 116,168.05, eight of between EUR 5,000 and 6,000 between 2 and 20 March, EUR 23,023 on 23 March and EUR 50,050 on 30 March, the day support was telling customers that every withdrawal was being processed manually. Amounts in the format 5,005 and 50,050 are round figures plus one per mille, exactly like the exchange’s transfers to its own accounts at Sygnum; it looks as if they were keyed in on the exchange’s side with the same mark-up as its own transfers, though that is an inference from format, not from a document.

The same person sits on the governing body of one of the month’s largest corporate recipients. NGNP Digital OÜ, a company with an address at Lõõtsa tn 5 in Tallinn, received EUR 26,026, 35,035 and 52,488.73 on 19, 23 and 25 March, into an account at a Belgian bank, EUR 113,549.73 in all. The transfers carry no invoice number and no description of a service; they carry system references in the format used for user withdrawals. The statement alone does not establish the legal basis of these payments, and there is no invoice for them in the company’s ledger. According to the Estonian business register (code 14511495), the company’s board and beneficial owners are three Polish nationals; outside the register, the company exists in public sources only as a template website from 2018 in a Polish-language version, which matters insofar as no activity is visible that the exchange could have been paying for. The individual and the company that, according to the register, this person co-controls received EUR 229,717.78 in four weeks, including EUR 50,050 on 30 March and EUR 52,488.73 on 25 March, in the last week before payouts stopped. Two separate recipients, one question: were these two customers’ balances paid out on time, or something more. The same KYC files and the histories of both accounts will settle it; the order of checking is obvious: first those who were paid every day while others were not paid at all.

What customers were being told at the time

At the same time, Zonda’s customers were standing in the queue and waiting politely. Support’s replies were templates: the same sentences went to different people on different days, sometimes under different signatures. On 6 March at 5:03 p.m., support wrote, unprompted, that the “technical operator” had a problem with larger withdrawals in all cryptocurrencies, that smaller ones were going through as standard while larger ones required manual release “after full stabilisation of the system”, and advised cancelling a larger withdrawal and splitting it into withdrawals of 1 BTC each; that day the CEO received EUR 11,140.53 and the person from Arbon EUR 37,181.54. On 10 March it promised “priority treatment” and “maximum operational pressure”; that day the CEO received EUR 25,835.68 in two transfers. On 20 March it explained that “withdrawals are processed in the order in which the instructions were received” and that “cancelling and resubmitting does not speed up execution”; that day the person from Arbon received EUR 10,000 for the third day running. On 30 March, in a chat: “all withdrawals are processed manually by us, hence the extended waiting time”; that day the person from Łódź received EUR 50,050. On 31 March: a failure of the automatic funding of the operational wallet, funds “are being collected manually from deposit addresses”, the queue lengthened by the “geopolitical situation” and a “sharp increase in the number of orders”, but “the funds are completely safe”; that day the card gateway took in EUR 58,000 of fresh deposits. We wrote about that 31 March email in April.

Every ticket triggered an automatic warning: “every new message moves your thread to the end of the queue, which will extend the waiting time”. Agents’ signatures changed from one message to the next, with no continuity, and a message of 2 April signed with a man’s name contains verbs in the feminine form; it looks as if the text was pasted from a template and the signature chosen separately. Glitches on the way in were fixed within hours, deposits of ZND tokens were credited within two hours of being reported, and withdrawals waited for weeks. There was one withdrawal queue with two ends; customers were placed at the far one, and every question about a withdrawal moved their thread to the back of a second queue, the one for support.

A customer who, in the first days of April, looked into the blockchain himself was right on the facts: USDC transfers from the exchange’s addresses were going out, larger withdrawals were being executed, his own orders stood still. He could not have known that among those transfers were the daily morning transfers to the bank that funded the CEO’s payouts. Confronted with an accurate diagnosis, support replied on a Sunday that its departments worked only on business days.

Where the euro came from, and what happened to the USDC

Everything that went out had first to be paid in by someone. In all, about EUR 2.5 million arrived in March on the accounts of a company that its own trustee considers to have been permanently insolvent since the end of 2022. The gateways worked flawlessly; only the exit doors had faults. The largest stream was the ZEN payment gateway: 1,902 settlements of customer payments by card and app totalling EUR 1,109,228.54, median EUR 100, every day including weekends, swept daily into the main account. The payment operator ZEN.COM UAB transferred six round amounts totalling EUR 420,000 of unexplained nature, the CEO EUR 380,000.

With those euro the exchange bought 1,009,409.91 USDC at Sygnum for EUR 879,452.46, in nine purchases between 6 and 27 March. All nine amounts arrived the same day in the “Zonda 5” hot wallet, to six decimal places; the stablecoins did not vanish in the bank, they returned to the exchange and left from there. In March, 5.06 million USDC left that wallet, of which 1.87 million, 37 percent, went to a single address that forwards to a wallet labelled as Kraken, the same address that on 27 March took the 291,000 USDC from the purchase the CEO had paid for, and 0.65 million went to three addresses labelled as Binance deposit addresses. Recoveris described in April 511 transfers from the exchange’s wallets to that Kraken address between mid-December and 2 April, worth about USD 21 million. Who held the account on which Kraken credited those deposits, only Kraken knows, and that is a question the trustee and the prosecutors can put to it with a specific hash, instead of asking in general where the cryptocurrencies went. The blockchain has nothing more to say in this case, and nothing more is needed: it showed where the money for the CEO’s payouts was taken from and what happened to the wallet his deposit landed in.

The background is in the income statement for the sixteen months to 22 April, the last one the bookkeeper prepared: EUR 6.6 million in commission revenue, EUR 4.0 million spent on advertising, listings and partner commissions, EUR 2.1 million on advisory services with no names in the ledger, EUR 2.7 million in Orion’s IT invoices and EUR 1.7 million in VAT the company could not deduct. An income statement does not show the state of the till, but it shows the proportions: the exchange earned EUR 6.6 million in commissions and spent 4 million on advertising, advertising a company that, according to its own trustee, had by then been insolvent for three years.

What follows: § 113 of the Estonian act and Article 302 of the Polish Criminal Code

The Estonian Bankruptcy Act (Pankrotiseadus) governs the recovery of the debtor’s pre-bankruptcy transactions in § 109 and the provisions that follow. March fits § 113(1)(3) above all: the court revokes the performance of a financial obligation to a person connected with the debtor, made within two years before the appointment of the interim trustee, unless that person or the debtor proves that the debtor was solvent at the time of the payment and did not become insolvent as a result of it. The interim trustee was appointed on 27 July 2026; the CEO’s fourteen transfers fall inside that window with room to spare, and a member of the management board is a connected person by virtue of § 117. The trustee must show the payment, the period, the connection and harm to creditors’ interests, as the general § 109 requires; in a company he himself has found permanently insolvent since the end of 2022, that last element should not be hard. The defence is left with the proof of solvency, and that is the crux: a genuine claim of the CEO’s does not protect its satisfaction from reversal; only proof that the company was solvent at the time and was not rendered insolvent by the payment protects it, and that proof rests with him. This is a mechanism of insolvency law, not a reversal of the burden of proof in a criminal case. As regards the other recipients, § 113(1)(2) reaches back three months before the appointment of the interim trustee, that is to late April, and does not cover March transfers; § 110 concerns the recovery of legal transactions rather than the performance of an obligation, with its own periods and its own requirements as to the other party’s knowledge. For the recipients from Arbon and Łódź, establishing a connection with the company is therefore decisive for the two-year period of § 113; other grounds would require examining the basis and nature of the transaction itself. The answer lies in the KYC files of both accounts and in the contracts, if there were any.

On the Polish side, in the investigation that already covers the exchange’s operations, the qualification the prosecutors have applied in this case, in the charge against the president of the Polish Olympic Committee (in Polish), is Article 302 § 1 of the Criminal Code (Kodeks karny): paying off only some creditors when insolvency is looming, to the detriment of the others, in conjunction with Article 308, which extends that liability to a person managing the debtor’s financial affairs. There it concerned inducing selective payouts in April; here it concerns fourteen payouts in March to a person who knew the state of the company best, because the management balance sheet as at 31 December 2025, printed on 5 March, showed him EUR 3 million in cash and EUR 343 million in cryptocurrencies sitting at an address to which, as he announced in April, there was no key. The elements of that provision are more than a transfer to a board member’s account: the company’s position on the payout dates, other unsatisfied claims, the rules for executing orders and who decided on the payouts; the statements indicate which operations need explaining, and there their role ends. Other qualifications, including Article 300 § 1 of the Criminal Code, depend on establishing title to the funds and who controlled them after they were passed to another exchange, and we do not prejudge that today. The mere receipt of a payout by the person from Arbon, the person from Łódź or NGNP Digital OÜ decides nobody’s liability. These are the legal assessments of counsel for the victims; to our knowledge, no one has been charged in connection with the March transfers described here, and everyone named enjoys the presumption of innocence. The whole difficulty of this case, until now, was that the books contained no names. The statements do, and that is where the work begins, not where it ends.

Facts and law as at 15 September 2026. The bank statements for March 2026 are company documents held in the file of the bankruptcy proceedings of BB Trade Estonia OÜ before Harju County Court (Harju Maakohus); amounts have been rounded, and neither account numbers nor the full details of natural persons other than board members are given. On-chain data concern the USDC contract on Ethereum and the wallet labelled Zonda 5 on Etherscan; address labels are the explorer’s attributions, not proof of ownership, and transaction hashes are in the annex. Estonian business register data as at 15 September 2026. Quotations from customer support are the exchange’s templated communications of March and April 2026, recurring in the correspondence of many victims; we attribute them to no particular person. The interim trustee’s findings are his assessments at a preliminary stage of the proceedings; the Recoveris findings come from an external report. Legal assessments are those of counsel for the victims; marked hypotheses remain hypotheses. To our knowledge, no one has been charged in connection with the transfers described; everyone named enjoys the presumption of innocence.

Robert Nogacki

Robert Nogacki, founder and managing partner of Kancelaria Prawna Skarbiec

Robert Nogacki is a Polish attorney at law (radca prawny), the founder and managing partner of Kancelaria Prawna Skarbiec (Skarbiec Law Firm), which has operated continuously since 2006. He specializes in disputes with the tax authorities, strategic advice on building cross-border structures, changes of tax residency, crypto-asset regulation, family foundations, and asset protection. He has advised the crypto-asset industry since 2014. For more than twenty years he has worked at the intersection of tax law, corporate structures, and the human reluctance to give the state more than the state is owed. He advises entrepreneurs from more than a dozen countries, from those on the Forbes list to those whose accounts the tax office has just seized and who do not know what to do tomorrow morning.

There are lawyers who practice law. And there are those who deal with problems for which the law has no ready answer. Since 2006 he has handled the WGI case (Warszawska Grupa Inwestycyjna, the Warsaw Investment Group), one of the longest criminal cases in the history of the Polish financial market, because some things must not be left half finished, even when they take two decades. A conviction was handed down at first instance in 2026. In the case of the collapsed cryptocurrency exchange Zonda (Zondacrypto, operated by BB Trade Estonia OÜ), he represents more than 130 victims in the criminal investigation conducted by Poland’s National Prosecutor’s Office and in the Estonian bankruptcy proceedings.

Kancelaria Prawna Skarbiec holds leading positions in the tax advisory firm rankings of Dziennik Gazeta Prawna (2023, 2024, 2025) and Rzeczpospolita (2024, 2025, 2026). It is a four-time winner of the European Medal (2015 to 2018), awarded by the Business Centre Club and the European Economic and Social Committee, and holds the title of International Tax Planning Law Firm of the Year in Poland (The Lawyer International Global Awards).

Robert Nogacki is one of the most frequently quoted tax law experts in the Polish media and the author of thousands of publications.

He believes that the law is too serious to be taken only seriously, and that the best legal advice is the kind that means the client never has to appear in court.