Money “from Suszek” Arrived Fifteen Months After He Vanished. The Exchange’s Contracts, Revealed

Eight million euros for the Riviera, paid in tokens. A hundred-million-euro credit line for Wojciech Sroka’s company. The founder’s own firm in the Emirates. Loans to Orion until March, 2026. The contracts nobody was supposed to see. And vaults with no bitcoin in them.

Kancelaria Prawna Skarbiec · Robert Nogacki, Attorney at Law · September 11, 2026, updated September 17, 2026

In June, 2023, fifteen months after Sylwester Suszek disappeared, the accounts of the Polish cryptocurrency exchange zondacrypto at a bank in Zug, Switzerland, received the equivalent of 1.3 million euros from an account held in his name; the exchange booked the money as repayment of his private loans at fifteen per cent. In October, 2025, the same exchange, which has not returned its customers’ money since April, 2026, and which an Estonian court declared bankrupt in August with 432 million euros in liabilities and 167,000 euros in identifiable assets, paid 7.99 million euros to a woman from the circle of the man who owns the gas station in Czeladź where Suszek was last seen, in exchange for ZND tokens settled at a price ten months out of date. In July, 2025, it took back fifty-eight million euros in cryptocurrency from Wojciech Sroka’s company under a credit line capped at a hundred million. In 2020, the founder had lent himself the exchange’s money through his own company in the United Arab Emirates, at two per cent, for ten years, against cryptocurrency held on his own exchange. And the exchange kept wiring money to a company called Orion in Katowice until March 16, 2026, weeks before the withdrawals froze. Below is what could not be seen from outside, and what turns out to confirm our earlier findings.

I need hardly add that none of the information in this piece comes from the criminal investigation. I write about contracts the company itself concluded, books it kept itself, and statements of its own bank accounts; the secrecy of an investigation protects what prosecutors have established, not what a chief executive has signed. Is it worth publishing? I have handled the WGI case, the collapse of a Warsaw brokerage house, for twenty years, and I regret no piece of information I made public in that time. I regret the ones I did not, because everything that went unpublished was swept under the rug. In affairs of this kind, the rug is always large enough. The only thing that does not fit beneath it is what has already been published.

Zonda: The Money “from Suszek” Came Back in June, 2023

BB Trade Estonia’s accounts at SEBA Bank AG, in Zug, show two credits: 1,041,826.22 euros on June 6, 2023, and 1,323,493.15 złotys on June 12, 2023. The sender, in both cases: “Sylwester Jan Suszek,” with an address in Zug. Fifteen months after Czeladź. In an e-mail to the exchange’s Estonian bookkeeper on December 7, 2023, copied to Kral, the exchange’s in-house advocate explained that these were repayments of the four loans with fifteen per cent interest, and attached the arithmetic: 708,150.68 euros, 281,534.25 złotys, 3,366,095.89 złotys, and 1,323,493.15 złotys. The last figure matches the bank statement to the cent. The bookkeeper wrote back that the first item showed “400 thousand more” and asked where it had come from.

The bookkeeper asked where the extra four hundred thousand had come from. In this affair, that question is rarely asked; the usual question is where so much less went.

The loans have contracts. There are four, between BB Trade Estonia, represented by Suszek, and Sylwester Suszek in person: 500,000 euros dated July 31, 2020; 200,000 złotys dated August 31, 2020; 900,000 złotys dated April 21, 2020; and 2,500,000 złotys dated February 9th, of a year given inconsistently, 2020 in the text of the contract and 2021 in the exchange’s own reckoning. All at fifteen per cent a year. All falling due in May and June of 2023: May 10th, May 20th, June 2nd, and June 10th. No collateral. The scans of these contracts bear the date on which they were made, May 10, 2023, the first of those due dates. Two of them, the 500,000 euros of July 31, 2020, and the 200,000 złotys of August 31, 2020, repeat to the day and to the cent the loans to S.B. Bay FZE, Suszek’s company in the Emirates, described in the next section; they differ in the borrower, in the rate (fifteen per cent instead of two), in the term (2023 instead of 2030), and in the absence of security.

In May, we set out three hypotheses about the disappearance: that Suszek is alive and in hiding; that he was the victim of a crime; and that, whatever his fate, his absence performs a specific function in this affair. We wrote then that if he were alive he would not be hiding alone, and that a man of his profile would have left a trace. Here is a trace, and it is in the exchange’s own books: a bank account in his name, from which, in June, 2023, the equivalent of 1.3 million euros was transferred to the exchange. The trace does not say who held the pen. The exchange documented the same money twice, once as a loan to the Emirati company at two per cent until 2030 and once as a loan to the man at fifteen per cent until May, 2023, and it booked the payments from Zug against the man, not the company, since a year later the loans to the company still stood open, as the next section shows. Something else is visible, and for now it is a hypothesis rather than a finding: contracts falling due in May and June, 2023, scanned on the first of those due dates, with interest computed in the exchange’s reckoning precisely to those dates, look as though they were drawn up to fit the repayments rather than to precede them. We wrote in April that Kral had earlier held a power of attorney over Suszek’s assets. Both readings of these statements, the one in which Suszek is alive and repaying and the one in which someone else disposes of his account, fit within our third hypothesis. Only prosecutors, who can put questions to a bank in Zug, can settle it. If they do not yet have these statements, they should.

Zonda and S.B. Bay FZE: The Founder Lent Himself the Exchange’s Money Through a Company in the Emirates

S.B. Bay FZE is a company registered in the free zone of Umm Al Quwain, the smallest and least conspicuous of the seven emirates, under license No. 6951, with an address in the Al Shmookh Building business center. An FZE, a free-zone establishment, is the Emirati form of a single-shareholder company. Its director and owner was Sylwester Suszek; so the exchange’s own management described it in the statement of related-party transactions for 2023, digitally signed by Kral on May 20, 2024, in the column marked “borrower.”

In the summer of 2020, this company borrowed from the operator of the exchange three times: 500,000 euros under an agreement of July 31, 2020; 495,000 złotys under an agreement of August 26, 2020; and 200,000 złotys under an agreement of August 31, 2020. All three were signed in Tallinn. For the lender, BB Trade Estonia, Sylwester Suszek signed as a board member; for the borrower, Sylwester Suszek signed as director. The terms are identical: two per cent a year; repayment by 2030 (by July 31st, August 26th, and August 31st, respectively), in installments at the borrower’s discretion, with installments credited first to principal and only then to interest. Security: a pledge on the cryptocurrency held in a wallet named “sbbayfze” on the platform bitbay.net, “operated and owned by the Lender”; the pledge consists in preventing the borrower from freely disposing of the funds in that wallet, and it is deemed delivered to the lender the moment the contract is signed. Disputes go to the court having jurisdiction over the borrower’s seat, which is to say, Umm Al Quwain. In banking, this order of repayment is called preferential terms. In a family, it is called a loan.

Lender, borrower, and custodian of the collateral: all three parts were played by Sylwester Suszek in person. The fourth, the competent court, he entrusted to the Emirates.

Together, 500,000 euros and 695,000 złotys, about 650,000 euros at the exchange rates of the summer of 2020. As of December 31, 2023, the company in Umm Al Quwain had repaid neither principal nor interest: the exchange’s receivable stood at 500,000 euros plus 34,219 euros in interest and 695,000 złotys plus 46,520 złotys in interest, the interest accrued at two per cent since the summer of 2020. Kral’s signature under that statement is dated May 20, 2024, a year after the payments from Zug described above. Let us call the thing by its name: the founder of the exchange lent himself the exchange’s money through his own company in the Emirates, at two per cent, for ten years, against cryptocurrency he kept on his own exchange, with a court in the Emirates in case of dispute, and three years later had repaid nothing. The year 2020 was fertile in this respect. Pinewood Estonia, as the company was then called, lent 295,285 złotys and 50,000 euros in January and March, 2020, to Taxsaprent, a Katowice firm for which the contracts were signed by Kral, at three per cent, due in 2030. We wrote in April that the exchange was lending out its customers’ money; it now appears that it began by lending it to its own officers.

The Emirates recur in this story with some regularity. Marian W., in his contract of May, 2021, gives an address in Dubai. Three Dubai companies took over the shares of BitBay sp. z o.o., the exchange’s Polish predecessor, as we described in a piece about the company that vanished in plain sight. Luxembourg recurs, too. The statement of related parties lists, as the exchange’s ultimate beneficial owner until July 12, 2021, LuxBay S.A., registered in Luxembourg under No. B237593. S&B Investment S.A., the company from which Suszek was formally removed on November 14, 2023, six hundred and twenty-four days after his disappearance, as we wrote in the piece on the five acts of his exit, bears the number B237594. Luxembourg assigns its registry numbers consecutively. Two companies registered one after the other: one held the exchange, the other belonged to its founder. Who registered both, and for whom, is a hypothesis for another piece; the adjacency of the numbers is a fact.

Zonda and the Circle of the Czeladź Gas Station: Suszek Signed Two Contracts, Kral Signed the Third

On October 8, 2025, a notary’s office in Villefranche-sur-Mer, on the stretch of coast between Nice and Monaco, issued a buyer’s settlement statement in a file labelled “Vente SCI Riviera Mas.” Purchase price: 7,500,000 euros. Fees and taxes: 492,480 euros. Balance to be wired three days before the signing of the deed: 7,992,480 euros. The buyer was a Polish woman living in Andorra. The next day, October 9th, she sent a one-page order to Przemysław Kral, the chief executive of BB Trade Estonia OÜ, the Tallinn company that operated the Polish cryptocurrency exchange zondacrypto: convert 13,352,871.75 ZND tokens into 7,993,000 euros, at a rate fixed in a confidential agreement, and credit the euros to her account. The difference between what the notary wanted and what the exchange paid out was 520 euros.

Let us go back to May, 2021. On May 21st, Sylwester Suszek, still a board member of BB Trade Estonia, signed a credit-line agreement in Tallinn with Marian W., then resident in Dubai. (Polish press custom, and the law that shapes it, abbreviates the surnames of people who have been charged but not convicted; the initials are theirs, not ours.) The preamble is a document in its own right. The client, it says, is a user of the exchange under the name “marianitsolution”; his account has existed since February 11, 2021; he “consistently achieves significant profits”; the operator “has assessed the client’s potential and investment skills.” On that basis, the exchange credited his user account with a 1,500,000-złoty credit line for an indefinite term, at four per cent a year deducted from his balance, with a confidentiality clause and a 25,000-złoty penalty for each breach. The exchange’s general ledger knows this line as “Laen PMW 1.500.000 PLN till 31.07.30 4%”: paid out on May 21, 2021 (334,135 euros), zero repayments, a balance of 355,000 euros after revaluations as of April 27, 2026.

The contract opens with an assessment of the client’s investment skills. The assessment must have been favorable; in five years, no one has asked for the money back.

Three days later, on May 24, 2021, Suszek signed a second agreement, with Jaromira W., a resident of Andorra: a credit line of 2,910,000 euros “for the purchase of real estate,” to be paid directly into the escrow account of a notary’s office in Nice, for twenty years, at two per cent a year (58,200 euros, payable by December 31st of each year), the principal due in full after two decades. Security: a mortgage for a hundred and twenty-five per cent of the sum on land in Poland, to be registered “within twelve months,” plus a blank promissory note. The general ledger, account “Loan JDZ”: on June 2, 2021, a transfer of 2,878,500 euros to the notary in Nice; one repayment, of 162,594 euros, in November, 2024; a balance of 2,715,906 euros. The ledger records no interest. Whether the mortgage was ever registered is not known. It was to exist within twelve months; sixty-three have passed, and the deadline has proved more elastic than the property.

The dates speak for themselves. Suszek signed both contracts in the period when he was handing the exchange over to new management, five weeks before the first act of the exit we reconstructed in May: his removal from the British company BB Trade Pro Limited on June 30, 2021. On March 10, 2022, he was seen for the last time at a gas station in Czeladź, a small town in the coal country of Upper Silesia, owned by Marian W. Under the contracts of May 21st and 24th, more than 3.2 million euros left the exchange for two people from that circle.

The third contract was signed by Przemysław Kral. The “ZND Token Exchange Agreement” between Jaromira W. and BB Trade Estonia is dated “on or before January 1, 2025.” It gives her the right to convert 13,352,871.75 ZND into 7,993,000 euros at 0.5986 euros per token, described in the agreement as the average closing price on December 31, 2024, exercisable within twelve months, under a confidentiality clause. The execution order is dated October 9, 2025. The day before, the notary’s settlement had named the figure of 7,992,480 euros.

The agreement was concluded “on or before January 1, 2025.” The document knows the latest date on which it could have come into being; it does not know the actual one.

The exchange rate deserves a sentence of its own. The ZND token peaked in November, 2024, so 0.5986 euros at the end of December, 2024, is a credible figure. On the day the option was exercised, the market stood several times lower: the exchange’s own settlement from July, 2025, described below, valued ZND at 0.155 to 0.161 euros, and an internal memo on a transaction in September, 2025, at 0.24 dollars. Converting at the price of ten months earlier transferred to Jaromira W. roughly five to six million euros above the market value of her tokens. We wrote in July and August about how the exchange propped up the price of ZND and how it made this money out of nothing; this contract shows who benefitted from keeping the December, 2024, price alive in the paperwork. The December price survived in the contract ten months longer than it did on the market. The market had no confidentiality clause.

In early September, Jaromira W. and a second woman, Anna P., were arrested and charged with participating in a criminal group that operated from 2020 to 2026 with the aim of taking over Suszek’s assets, with causing the company damage on a grand scale, with money laundering, and with obstructing the investigation, as we reported at the time of the arrest of Rafał Z.. The reports of the charges speak of “nearly eight million złotys” taken from the company’s account for real estate in France. The contracts and transfers speak of 7.99 million euros in 2025 and 2.88 million euros in 2021. The digits agree; the currency awaits checking. We describe contracts and transfers, and prosecutors frame charges; the two need not match to the cent to concern the same property.

Zonda and Admitrade: A Hundred-Million-Euro Credit Line

On September 12, 2022, BB Trade Estonia concluded a credit-line agreement with AdmiTrade OÜ, an Estonian company belonging to Wojciech Sroka: financing in fiat currency “with the possibility of further trading on the Client’s side.” It is the same template that had served, a year earlier, for the line to Marian W.: exchange operator, client, user account, balance monitoring. The difference is one of scale. Addendum No. 1, of December 4, 2023, signed by Kral and Sroka, announces a “ZND platform” with an Earn program and a ZND utility token, names Admitrade the “strategic liquidity provider,” and sets the limit of the line at 100,000,000 euros. The funds may be used on other exchanges and platforms, for arbitrage, market making, staking, collateralized lending, loans to related parties, investments in the ZND token and the ZND platform and the development of Admitrade’s software, and for “general cryptocurrency trading.” The interest rate is set by the operator at each drawdown; interest is payable weekly, by Wednesday at 3 P.M.

The security is set out in a paragraph of thresholds: the client keeps on his exchange account funds worth at least forty per cent of the amount drawn; below forty per cent the exchange blocks his withdrawals, below thirty-five it telephones, below thirty it takes over the funds in the account, and below twenty the agreement lapses and the client pays the rest in cash within ninety days.

The collateral for a loan made with customers’ money was the customers’ money in the borrower’s account. The risk stayed in the family.

How much of the line was in use at the end of 2023 we know from the same correspondence with the bookkeeper: 2,211,418 euros, 2,940,000 złotys, a million USDT, twenty bitcoin, a hundred ether, 200,000 ADA, 500,000 DOGE, 20,000 DOT, 200,000 XRP, 1,500,000 TRX, a billion SHIB, ten billion PEPE, and several dozen smaller positions. How much was in use in July, 2025, we know from the termination agreement of July 28, 2025, digitally signed by Sroka and Kral the same day. Between those two dates lies the opening balance for 2025, which we described alongside the interim trustee’s report: on January 1, 2025, the accounts “Admitrade EARN fiat” and “Admitrade EARN crypto” stood at 14,448,098 and 75,016,307 euros, together 89.5 million euros, which is to say “laen 6” and “laen 7” from the exchange’s financial statements for 2024, at a time when the borrower was a name the Internet did not know. Now it has a contract, an address, and a signature: the customers’ money from the Earn program went into a credit line for Wojciech Sroka’s company. The stated reason for termination: the company had applied for a license under MiCA, the European Union’s crypto regulation, “which results in the need to adjust operational activities, including the termination of existing incompatible contractual relationships.” Appendix No. 1 lists two hundred and forty-five transfers made between July 23rd and July 26th, 2025, worth 58,264,534 euros at the closing prices of those days: 6,375 ETH (19.9 million euros), 6,324,988 XRP (17.1 million euros), 9,462,304 USDT, 6,724,240 USDC, 16,097 SOL, 12,005,745 ZND valued at 0.155 to 0.161 euros, 5,190,518 DOGE, 858,892 ADA, 5.28 BTC, and small change. The agreement closes with a confidentiality clause carrying a 100,000-euro penalty per breach, a submission to enforcement up to 200,000 euros, and the exchange’s right to audit the client’s wallets, accounts, and servers without notice. The arithmetic does not close: 89.5 million euros at the start of 2025, 58.3 million euros returned in July, and by April 22, 2026, both Admitrade accounts had fallen in the books to zero without any loss being recorded. Part of the gap is explained by cryptocurrencies revalued at different prices; the rest is explained by nothing. The interest accounts of Admitrade froze in January, 2025, at 194,000 euros and never moved again; they were the only element of the Earn program that stopped growing before the customers’ claims did.

MiCA asks a great deal of exchanges. Returning fifty-eight million euros in four days is the requirement least often observed.

In April, in Where Is Zonda’s Customers’ Money?, we described the conflict of interest of Wojciech Sroka, who designed the ZND tokenomics as head of the ICEO group, sat on the board of ZND Ventures, and co-owned the company that licensed software to the exchange; the ZND white paper itself called this conflict significant. The Admitrade agreement explains how the ecosystem was financed: with a credit line drawn on customers’ deposits, with the right to use it on other exchanges and for loans to related parties. What remains is a question without an answer: what became of fifty-eight million euros in cryptocurrency between July 26, 2025, and the declaration of bankruptcy, given that the interim trustee, as we showed in the piece on his report, found no cryptocurrency in the company at all. It came back, and then it left again. The direction of the second movement is the most important unknown in this affair.

Zonda in the Bahamas: Balances from Thin Air, and the Price of ZND

An internal memo of the exchange, titled “Where did BB Trade Bahamas get the ZND tokens?,” describes an operation of 2025 step by step, with links to the exchange’s own spreadsheets and screenshots. Between June 18th and September 8th, 2025, the technical account of BB Trade Bahamas Ltd in the zondacrypto system was credited “via balance adjustment,” which is to say by a correction of the balance, with 400,000 USDT and 4,900,000 USDC. The memo notes: “formally a loan or investment from BB Trade Estonia to BB Trade Bahamas; we do not have an agreement for this.” The funds were withdrawn to the Bahamian company’s account on the Gate.com exchange, where 18,250,092 ZND were bought. The tokens were moved to the ZND platform, 305,938 ZND were added from the exchange’s own liquidity account, and on September 12, 2025, 18,555,938 ZND were sold to a single user in an over-the-counter transaction for 997.6 ETH, at 0.24 dollars per token. The ether was deducted from the Bahamian account and credited to an Admitrade account; 597.5 ETH were withdrawn to Admitrade’s account at Kraken and sold for 2,314,325 euros; the euros travelled back through Admitrade’s accounts to the Bahamian account, where they were “removed via balance adjustment.” The unsold 400 ETH returned on January 28, 2026.

“We do not have an agreement for this,” the author of the memo wrote. It is one of the few sentences in this affair that no one disputes. The Nassau company had a director, an anti-money-laundering officer, and an accountant; what it lacked was a contract with its own parent for five million dollars. Compliance here began with job titles, not with documents.

We wrote in April about BB Trade Bahamas Ltd as a ghost company: listed in the consolidation policies of the 2024 financial statements and absent from the tables. The ghost turned out to have a body. Company No. 213148 B, of Nassau, traded under the name “Coin Accepted”; from June, 2024, it provided the exchange with outsourcing services; from February 21, 2025, it leased from the exchange its infrastructure, equipment, software, and virtual addresses for five per cent of gross profit a month; it had a local director paid five thousand dollars a month, a money-laundering reporting officer for ten hours a month, bookkeeping in Nassau invoiced to Orion Software, and 200,000 dollars in escrow as the capital required by the Securities Commission of the Bahamas. In March, 2025, it signed an agreement with a currency-exchange bureau in the small Polish town of Wadowice to supply a payment gateway for the bureau’s customers. Anyone who remembers where FTX moved will recognize the direction. We wrote, in an analysis of the exchange’s customer-support messages, that its hot wallet was topped up by hand for each withdrawal; the Bahamas memo shows that balances in the system were credited and erased just as manually, including for the company’s own purposes.

Zonda and Orion: A Fifty-Million-Euro Loan, Seventy-Five Million Paid Out, the Last Tranche on March 16, 2026

In April, analyzing the financial statements for 2024, we found loans labelled “laen 1” through “laen 7” without the names of the debtors. In June, we identified Orion Software as one of two group entities to which the exchange’s money might have flowed. Alongside the interim trustee’s report, we showed that the loan to Orion is a separate account, one that grew between January 1, 2025, and April 22, 2026, from 36.16 to 75.08 million euros plus 5.5 million euros in interest, and we wrote that its maturity was known only to the contract of August 4, 2022, “which no one has seen except the parties.” Now everyone can.

The loan agreement of August 4, 2022, signed by Kral for BB Trade and by a proxy for Orion: 50,000,000 euros, disbursed in tranches “in amounts and on dates mutually agreed,” each tranche repayable within ten years of disbursement, at ten per cent a year, with no security of any kind, and with a clause allowing the lender, at its discretion, to settle repayment by converting its claim into Orion’s share capital. Addendum No. 2, of January 1, 2024, lowers the interest to 4.6 per cent and makes it payable “at the end of the term of the Agreement and repayment of the last tranche.”

The addendum moved the interest to the end of the contract. The loan became maintenance-free: it asks nothing of the debtor except survival. Ten years from each tranche means that the last one, of March 16, 2026, falls due on March 16, 2036; the trustee can wait for it, the creditors probably cannot.

The general ledger, account “Orion loan agreement 04.08.22,” printed on April 27, 2026, five days after the chief executive’s statement from Monaco, runs to more than a hundred and seventy entries. The first tranche: 124,949.30 euros on August 8, 2022. Then month after month, half a million, a million, two. On November 3, 2025, 4,590,000 euros; on November 6, 2025, 1,350,000 euros: nearly six million euros in four days, five months before the withdrawals froze. Liquidity the exchange had to the very end; the problem was only its direction. On December 31, 2025, 644,000 euros. On January 7, 2026, 200,000 euros; on January 16th, 17,000 euros; on February 9th, 117,624.92 euros; on March 16, 2026, 20,000 euros. Closing balance: 75,084,120.12 euros, to the cent what the trustee found. Some entries are labelled “Zen Regular outgoing”: monthly payments through ZEN.com, the Lithuanian payment institution we wrote about in the lesson of Madoff, booked as loan. Next to that account sit two more: 19,272,407.58 euros of Orion’s share capital and premium (a reclassification from 2022 and increases on April 26th and July 16th, 2024) and 5,429,362.15 euros under “Investment agreement,” including Orion’s bills paid through ZEN.com every month until March 31, 2026. In all, 99.8 million euros before interest, about 105 million euros with the interest accrued up to the day of the freeze, as we calculated alongside the trustee’s report. The freeze came in the first days of April.

The 2022 contract was not the beginning. Alongside the trustee’s report, we recalled, from the exchange’s financial statements for 2021, that an investment agreement with Orion had already been concluded in 2020; here is what it said. On March 2, 2020, in Katowice, BB Trade Estonia, then still represented by Suszek, undertook to capitalize Orion, which at the time was Kral’s private company with five thousand złotys of share capital, up to 100,000,000 złotys, in monthly payments of between a thousand and five million złotys, converted once a year into share capital. Orion’s articles of association, of January 16, 2020, authorized the board to raise the capital to 500,000,000 złotys by the end of 2035. A company with five thousand złotys of capital had statutory room for half a billion.

What Orion did with the money is told by its financial statements for 2025, which as of September 9th had not yet appeared in the Repository of Financial Documents of Poland’s National Court Register, although the filing deadline passed in July. Liabilities on loans from the related party grew in a single year from 161,432,192 to 334,795,058 złotys. Short-term receivables grew from 133,051,677 to 256,058,413 złotys, of which 254,132,309 złotys are “other,” described in an accounting note as “Loan and investment agreement Expofer.” Intangible assets: 79,663,133 złotys. Cash at year’s end: 188,701 złotys. Interest accrued and not received: 9,586,451 złotys; accrued and not paid: 9,824,009 złotys. Net profit: 707,129 złotys. Alongside the trustee’s report, we asked where Orion had found, in 2025, thirty-nine million euros of needs it had not shown before. The balance sheet answers: receivables grew by 123 million złotys and prepayments by 77 million, together 200 million złotys, more than the new borrowing. A company that in less than four years received a hundred million euros from the exchange ended 2025 with cash equal to a single tranche, the one of March 16th. The rest it lent onward. To whom, the next section says.

Zonda, Orion, and Expofer: Two Contracts from March 2, 2020

On the same day, in the same city, on the same template, a second investment agreement was signed: Orion Software, represented by Kral, undertook to capitalize Expofer Servis House s.r.o., of Ostrava, in the Czech Republic, up to 100,000,000 złotys, in monthly payments of between a thousand and five million złotys, converted into share capital. Expofer was represented at the signing by Sylwester Suszek, as its managing director (jednatel, in the Czech term).

Two contracts on the same template, on the same day: a hundred million into Orion and a hundred million out of it. In this group, money did not stand still even on the day of signing.

We wrote about Expofer in May, in the piece on Suszek’s disappearance: a Czech company, nominally a boat-rental business, whose intangible assets jumped from zero to 543 million koruna without an auditor, and from which Suszek was formally struck off by a notarial deed executed in Zug on January 3, 2022, nine weeks before Czeladź. We called it, then, a layering vehicle, and marked that as a hypothesis. The contracts and the accounts confirm it at every point. In the statement of related parties for 2023, Expofer appears as Kral’s company, with a receivable owed to the exchange of 8,293,987 euros and purchases of 2,046,754 euros in a single year; in Orion’s statements for 2025, as the addressee of 254 million złotys of receivables, booked as receivables from “other entities,” not related ones. Kinship in this group depends on who fills in the form. Expofer has filed no accounts in the Czech register for 2022, 2023, or 2024. The chain from exchange to Orion to Expofer, designed in March, 2020, with both chief executives at the table, ends in Ostrava, beyond the reach of the Polish register and of the Estonian trustee, unless the latter uses the powers of Orion’s sole shareholder, which we described alongside the trustee’s report.

Expofer has filed no accounts for three years. For a company in which a quarter of a billion złotys was parked, that is discretion worthy of private banking.

Zonda and ZND Ventures: A Five-Million Cap, Eighteen Million Paid Out

The investment agreement of August 10, 2022, between BB Trade Estonia and ICEO RED Venture Builder OÜ provided for a company called NORION OÜ, owned in equal halves, and for financing of 1.5 to 2 million euros in interest-free loans convertible into capital. An addendum of May 24, 2023, renamed NORION as ZND Ventures OÜ, announced the ZND.CO platform, raised the cap to between four and five million euros, and obliged ICEO to transfer all its shares to the exchange by January 31, 2024; under an agreement of January 10, 2024, the exchange bought out ICEO’s shares at par, and the share capital of ZND Ventures was raised to 10,000 euros. The general ledger, account “ZND Ventures OÜ”: disbursements totalling 18,574,553 euros, monthly payments of between 430,000 and 600,000 euros through 2024 and 2025, conversions into reserve capital of 2,500,000 euros in December, 2024, and 2,414,500 euros in May, 2025, smaller transfers until March 6, 2026, and a balance of 13,660,053 euros. That the ZND token was financed from the deposits of a regulated exchange, we wrote in April and July; now we know the amount.

The cap was raised from two million to five, after which eighteen were paid out. In this group, limits do not mark boundaries; they commemorate intentions.

Zonda Sold Its Stake in a Bank in January, 2025

In April, in a piece on Zonda’s Swiss investment, we asked why BB Trade Estonia was disappearing from the list of holders of AMINA Bank AG, formerly SEBA Bank, a crypto bank in Zug. The answer is dated January 21, 2025: a share-purchase agreement selling 781,250 registered participation certificates of AMINA Bank to LL (BVI) Investment Limited, of Tortola, in the British Virgin Islands, at 3.40 Swiss francs apiece, 2,656,250 francs in all, under Swiss law, subject to the consents of the bank, the other holders, and the regulator. The buyer signed on January 22, 2025. For years, the exchange had presented this stake in a Swiss bank as proof of its seriousness. Alongside the trustee’s report, we showed that in the exchange’s books the SEBA position fell between January 1, 2025, and April 22, 2026, from 3.79 million euros to a single cent, with no cash coming in and no loss going through the accounts. The contract says what the stake was sold for; the books do not say where the price went.

The anchor was sold while the ship was still under way. At 3.40 francs apiece, payable to an account the books do not remember.

Zonda, Juventus, and Raków: 4.6 Million Euros for Shirts

The advertising and promotion agreement with Juventus F.C. S.p.A., the Turin football club, dated January 12, 2024, and signed by Kral, runs until June 30, 2026. The fee: 500,000 euros for the 2023/24 season (400,000 on signing, and no partnership announcement until that payment arrives), 1,100,000 euros for 2024/25 and 1,100,000 euros for 2025/26, each with bonuses of 100,000 euros for participation in the Champions League and for the Italian title, plus V.A.T. An addendum of January 25, 2024, bought, for the remainder of the 2023/24 season, the left sleeve of the first team’s shirt in Serie A and the Coppa Italia, additional minutes on the stadium screens, a “Squad List powered by zondacrypto” on the club’s social media, and a photo shoot with five players, with a request for Wojciech Szczęsny and Arkadiusz Milik, the two Poles then on the squad, for an additional 1,200,000 euros, of which 1,100,000 was payable by January 29, 2024. A contract of June 6, 2023, with RKS Raków Częstochowa, then the freshly crowned Polish champion, made zondacrypto its strategic sponsor for 320,000 euros in the 2023/24 season and 352,000 euros in 2024/25, plus success bonuses. In all, some 4.6 million euros of marketing commitments entered into during a period the interim trustee has described as permanent insolvency, and, in the Juventus contract, with an express right to refer to the ZND platform.

The left sleeve of the Juventus shirt cost 1.2 million euros for half a season. It was paid for by the exchange’s customers, most of whom support other clubs.

The sleeve also had a procedural use. When the Regional Prosecutor’s Office in Katowice closed the first investigation into blocked withdrawals, in April, 2024, its reasoning noted, among other things, that the exchange continued to operate and sponsored Juventus. Two years later, prosecutors are seizing the suspects’ assets, and we know what the sponsorship was paid with. The argument of 2024 was, in fact, true: the exchange was operating. It was operating for Juventus.

Zonda: 4,514 Bitcoins in Cold Storage in 2020. The Last Certificate

There exists an eighty-page statement by BB Trade Estonia, dated June 18, 2021, and signed by Suszek as chief executive, declaring that the attachments reflect the state of the exchange’s wallets as of December 31, 2020. Each page of the attachments bears a handwritten formula, “I, the undersigned Sylwester Suszek, hereby certify that information given above is true,” and a signature. For ERC-20 tokens, the source is a screenshot from Etherscan; for some currencies, BitGo statements. For bitcoin, ether, litecoin, XRP, DASH, and several others, the source is “Funds Monitor,” the exchange’s internal system. Bitcoin cold wallet: 4,513.93 BTC as of 11:59 P.M. on December 31, 2020; hot wallet 308.48. Ether cold wallet: 51,646.73 ETH; hot 781.07. XRP cold wallet: 21,747,337.96. At the prices of that day, about 170 million dollars in bitcoin and ether alone. The bitcoin figure is eleven coins higher than the balance of the dormant wallet we have written about, 4,503 BTC; whether it is the same wallet, the certificate cannot settle, because for bitcoin it gives no address, only a chart. The ether addresses in the certificate are labelled “Zonda 2” and “Zonda 3” on Etherscan today.

For bitcoin, the auditor received a chart from the exchange’s internal system. The chart showed that the money was there. Charts generally do.

This is the last known certificate of the exchange’s reserves. We have written about the ten years of silence of the cold wallet, dismantled the narrative that Suszek holds the keys, and on September 12th showed that Kral notarially certified access to 4,503 BTC as early as June, 2025, for the 2024 balance sheet, and that without that address the cover for customer liabilities stood at about three per cent. The interim trustee found that the company lost access to its cold wallet at the end of 2022, and that the bankrupt estate contains no cryptocurrency whatever. Between the 4,514 bitcoins of December, 2020, and the zero of August, 2026, lie two years in which the contracts described above were signed. And between Suszek’s certificate and Kral’s statement lies a file that shows what the exchange really kept in its safe.

Zonda: Vaults Without Bitcoin. 685,000 Wallets in Fireblocks and 0.000012 BTC

On New Year’s night 2024, at 00:00:37 Warsaw time, someone at Zonda clicked “export” in Fireblocks. Fireblocks is the digital vault in which the exchange kept the keys to its customers’ wallets. The file created that night now sits in the bankruptcy file before Harju County Court and lists everything the exchange held in the second it closed its financial year: 685,738 wallets in 227,496 vaults, in close to two hundred currencies and tokens. A cold vault with 4,796 ETH and 40 million dogecoin. A hot wallet, a gas station, a bridge, a compartment named “Manual TopUp.” And bitcoin: 0.000012 BTC. The cold vault’s two bitcoin addresses were empty.

So the exchange had a professional safe for everything: for ether, dogecoin, solana, cardano, for a hundred and fifty tokens nobody buys any more. It had none for a single currency, the one whose screenshot the CEO would show fifteen months later, saying the missing founder had taken the key. Those 4,503 bitcoins, worth 405 million euros on the balance sheet date, more than two and a half times everything held in Fireblocks and BitGo combined, were in no vault at all. They sat on an address from 2016, locked with a single key, like a drive in a desk drawer. A company that keeps 4,796 ETH in a vault whose key is split between the firm and the system does not keep 4,500 BTC in a drawer out of habit. It keeps them there because there is nothing to move into the vault. That is a hypothesis. The rest of this part is fact, from the same file.

Because the file has a second layer. Vaults are numbered in sequence, so they tell you when they were created. Nine in ten were created after March 2022, after the disappearance of Sylwester Suszek, from which point, as I showed in the piece on Kral’s notarised statement about 4,503 BTC, the exchange closed its balance sheet with that one address. A hundred thousand in 2024 alone. The last one on New Year’s Eve at 18:11, six hours before the snapshot. The deposit-taking machine ran at full speed through four years of the hole. The cold vault, meant to be a reserve, breathed like a hot wallet until the last night of the year, and in 2025 everything with a price left it. In April 2026 the machine was still running three days after the CEO’s statement.

A Safe for Everything Except Bitcoin

Zonda moved to Fireblocks in the spring of 2021, still under its old name: the EOS accounts in the export are called “bitbayneteos” and “bitbaynetstg” to this day. The system is built from compartments called vaults. Thirteen of them are company vaults, with names that speak for themselves: Default, Network Deposits, HOT, COLD, HOT – Prod, GasStation, GasStation 2, Bridge, OCEAN – SWAP, Deposit Wallet, “Manual TopUp,” Users and one test vault. The remaining 227,483 are customer vaults, created the moment a customer first asks for a deposit address. Sweeping deposits from those vaults into the hot wallet worked down to the dust.

For every supported currency a vault receives an address. The COLD vault received them for ether, dogecoin, solana, XRP and bitcoin, as for everything else. Under the ether address, on the balance sheet date, lay 4,796 ETH; under the dogecoin address 40 million; under the solana address 42,800. Under the two bitcoin addresses lay zero. And not only in the cold vault: across the whole system customers had 16,368 deposit addresses for dogecoin, 8,673 for cardano, 8,479 for litecoin and 258 for bitcoin. Bitcoin, the largest line on any exchange’s balance sheet, had been taken out of this system. Customers depositing bitcoin were served by a second custodian, BitGo, which on January 1, 2025, held 59.9 of them. The rest of the cover was the address from the Riviera. Fireblocks counts balances to a dozen or more decimal places. The exchange’s entire bitcoin fitted into the sixth.

A Counter Nobody Reconciled

Customer vaults are numbered in the order they are created, and the wallets inside a vault that nobody ever touched carry a timestamp from the moment of birth. Put the two together and you can watch the exchange grow; the method and its caveats are in the annex. From March 25th to the end of 2021, 14,846 vaults were created. In 2022, 34,901. In 2023, 78,273. In 2024, 99,463. By the end of March 2022, that is, by the founder’s disappearance, the exchange had created 20,230 vaults; 207,253 came later, when, according to its own reconciliation sheets, it held a fraction of what it owed its customers. More than three quarters of all customer vaults were created in the exchange’s last two full years of operation.

In the piece on the CEO’s statement I described the mechanism: as long as customers deposited more than they withdrew, one customer’s withdrawal was paid from another’s deposit. Here you can see where that difference came from. The record month was March 2024, roughly 12,500 new vaults, four hundred a day. On February 2, 2024, Juventus announced Zonda as its official crypto exchange partner; in mid-March bitcoin set a record above 73,000 dollars. Bitcoin was breaking records, Juventus was advertising the exchange, the exchange was opening four hundred vaults a day. Everything worked, except the cover.

In the autumn of 2024 the pace halved, to about five thousand a month, but not to zero. In December 2024, while the company was preparing the wallet reconciliation sheet described as made for the auditors, the exchange created another five thousand vaults. The last, number 230,063, at 18:11 on New Year’s Eve. The customer who asked for it received a deposit address from an exchange that, by its own sheets, had no way to repay the previous ones, and six hours later became a line in the file for the auditor.

A Cold Vault with 26,000 Transactions

The COLD vault’s ether address, 0x781229c7…, carries the public Etherscan label “Zonda 2”. Until now that was a third-party attribution; the company’s own export confirms it through the key derivation path (m/44/60/3/0/0). The same holds for the hot wallet 0x6EDF968D…, labelled “Zonda 5”, and for the gas station 0x5BfF49Ee…, labelled “Zonda: Deposit Funder 1”, from which the exchange paid network fees. Anyone who wants to check what the exchange did no longer has to trust labels. They have vault numbers.

On December 31, 2024, COLD held, among other things, 4,795.92 ETH, 39,900,054 DOGE, 42,800 SOL, 14,068,379 TRX, 5,900,001 ADA, 513,139 DOT, 4,200,001 ALGO, 3,185,000 MATIC, 237,733 LINK, 17,993 LTC, 25,800 AVAX, 1,500,000 USDC and 1,200,000 USDT on Tron. Figures like these do not arise from customer deposits, which end in random digits. They arise when someone transfers into a vault exactly enough for the balance to land on a set level.

It was being set until the end of the year. The last-balance-change column shows a run of twelve currencies changed on December 5, 2024, between 16:25 and 16:57 Warsaw time, then LINK on December 16th, MATIC on December 18th, ADA and DOGE on the morning of December 23rd, SOL on December 28th, TRX and USDT on December 30th at 14:24, and ether in the night of December 30th to 31st, at 01:26. Whether the December movements fed the vault ahead of the balance sheet or drew from it will be settled by the chain, since the direction of each is public; that reconciliation is in progress and this piece does not prejudge it.

The “Zonda 2” address has 26,501 transactions to its name since September 2021, when it received its first ether from the hot wallet. Zonda’s cold vault breathed more often than many a hot wallet. In this export the word COLD describes the name of a compartment, not a method of storage: this was an operating buffer, topped up and drawn down, under the sign of a reserve.

What Is Left of the Cold Vault

Etherscan reading of September 15, 2026: the “Zonda 2” address holds 0.4999 ETH and tokens the service values at roughly 236,000 dollars: 22.1 million BCP, 132.8 million ATRI, 51.1 million GAME, 5.7 million NEU, 82 million FORM, 32.5 million PAY, 141.4 million BOB and 167.9 million REEF. Of the 4,796 ETH and 1.5 million USDC from the balance sheet date, nothing remains.

The provenance of what remains says more than what vanished. NEU: at the end of 2024 the COLD vault held 2,774,906.10 of these tokens and the hot wallet 2,940,239.49; today “Zonda 2” holds 5,715,145.59, the sum of both to the hundredth. BCP, ATRI, GAME, FORM and BOB sat in the hot wallet at the end of 2024, with none in the cold one; today almost all of them sit in the cold one. In 2025 and 2026 everything with a price left the cold vault, and everything nobody wanted to buy moved in. The cold vault ended up as a warehouse for tokens without a market.

Where the 4,796 ETH went I do not yet know for certain, and I will not guess. The legitimate route runs from COLD to the hot wallet and on to customers, who in 2025 withdrew ether faster than the exchange took in deposits. Transfers from cold to hot are visible on the chain as late as 2026: 2.002 ETH on January 15th and 1.5 ETH on March 13th. Whether every one of those 4,796 ether took that route will be shown by the full statement for the address, which I am working on.

April 2026: The Machine Ran for Three Days After the Statement

On April 16, 2026, Przemysław Kral announced that he did not have the keys to the wallet holding 4,503 BTC; a day later the prosecutor’s office announced its investigation. The Fireblocks vaults kept working. Tokens left the “Zonda 2” address throughout the first quarter of 2026: UNI, ZRX, FET, WLD and OMG on January 8th, SUSHI on January 12th, GLM and REPv2 on January 15th, BOB on March 11th, ENJ on March 20th, ZND on March 21st, POL on March 24th, USDC and ZND on April 2nd. The last movement was ZND on April 13th, three days before the statement.

The hot wallet kept working after it. On April 17th, 18th and 19th it received ether from more than a dozen addresses; at least three of them are customer vaults from the export, created in 2022 and 2024, so the sweeping of customer deposits into the hot wallet went on as on any other day. On April 19th about 1.39 ETH left the hot wallet: 0.6 ETH and 0.4 ETH to one external address, 0.37 ETH to an address Etherscan describes as a Binance deposit address, and four small amounts. The last outgoing transaction visible on the exchange’s hot wallet is a transfer to Binance made three days after the CEO told customers the money was not there. The machine was not copied in on the statement.

Who held Fireblocks permissions on April 19th and whose withdrawals these were, the chain does not say. Two hypotheses: an employee was processing a backlog of withdrawal orders, or someone was taking out the remainder. The answer lies in the Fireblocks audit log, which records every user and every approval, and it is within the trustee’s reach. Today the hot wallet holds 1.44 ETH, 4,042 EURC and tokens worth about 25,000 dollars.

The CEO showed a screenshot of an address to which nobody has the key. The Fireblocks export shows every address to which the company did have the key: 685,000 wallets, with about as much bitcoin in them as dust. The whole case fits between those two pictures. The vault counter adds a date to it: two in five customer vaults were created in 2024, the last at 18:11 on New Year’s Eve, at an exchange that was preparing, for that same night, a balance sheet closed with an address without a key. Every quarter management reconciled the wallets against customer balances, and every quarter the result was zero, because one line was large enough and never shrank. Nobody reconciled the vault counter. It is the one figure in this case the company produced without intending to, and the one figure nobody has to take on faith.

Zonda: Can Possession of a Cold Wallet Be Proved Without the Key?

The chief executive says the wallet exists; only the key was taken by the missing founder. Suppose he went a step further: he brings a pen drive to the trustee or to the court, puts it on the table, and says, “It’s here.” Does that prove anything?

In bitcoin there is no possession in the sense the civil code knows. There is no thing to hold in one’s hand; there is an entry on the chain and a private key that can change that entry. Whoever has the key has the bitcoin; whoever has only the medium has a box. The address 16aEn4p6… is, on the chain, a single-signature address: no multisignature script protects it, so no custodian has to co-sign with the owner. Whether that one signature stood for one file, a key split into shares inside a custodian’s system, or a backup in a safe, the chain does not say; it says only that one signature is enough. A single string of two hundred and fifty-six bits therefore decides the fate of 4,503 bitcoins, and because, as far as the chain shows, nothing has ever been sent from that address, the network does not even know its public key, unless someone disclosed it off the chain.

The evidence forms a ladder of five rungs. The screenshot the CEO showed on April 16th proves only that someone can type an address into a browser; every address’s balance is public, and anyone can set up a watch-only wallet on a bare address in a minute. The public key of this address, which the chain has not disclosed, proves access to material that is not public, though not where that access came from, and it does not prove control. An encrypted wallet file containing the private key is a box with the right lock, and the lock can be inspected without the password: in wallet files of that era, such as Bitcoin Core’s, the public key sits in the readable part of the record next to the encrypted private key, so an examiner hashes it and compares it with the address; whether a real key lies behind that lock, rather than random bytes, becomes clear only after decryption. A signature on a message set by the examiner, fresh and unpredictable, proves that the signer held the key at that moment; an old signature, or someone else’s, proves nothing. A transfer of a token amount from that address to an address named by the examiner proves control and liquidity. The trustee, the auditor, and the court accept the last two rungs. The notary, in June, 2025, certified the first.

From the third rung up, the pen drive has to reach an examiner’s hands, not the table. If the medium can be read, establishing whether the file contains a record for this particular address is a matter of days, not months; if the whole medium is encrypted, as with an IronKey, even that needs the password. Establishing the password may take an hour, if it was weak, or never end, if it was decent. The world knows both cases. Stefan Thomas, a programmer in San Francisco, keeps in a Swiss bank vault an IronKey drive with 7,002 BTC and has two password attempts left for the rest of his life; a Seattle firm, Unciphered, announced in 2023 that it could bypass the ten-attempt limit, and Thomas declined, having already made a handshake deal with two other teams; in 2026 the drive is still locked. James Howells has been fighting since 2013 for the right to dig up a landfill in Newport, Wales, where his drive with 8,000 BTC lies. In both cases, possession of the medium is undisputed and worth nothing. A safe can be shown, weighed, and photographed; only what comes out of it can be booked.

This is where the law begins. The exchange’s balance sheet for 2024 carried those 4,503 BTC as an asset, and the CEO certified them before a notary in June, 2025. An audit of financial statements with crypto-assets requires proof of control, not the existence of an address: the auditor asks for a signed message or a test transfer, just as, for cash, it asks the bank to confirm the balance. An asset the company cannot reach is, for accounting purposes, lost, and it is written off at the moment access is lost, which the interim trustee dates to the end of 2022. Bankruptcy works the same way: the estate consists of what the trustee can dispose of, so a pen drive without a password enters the estate as a pen drive. And whoever claims to hold the medium is also obliged to hand it over: the Estonian trustee may demand it from the debtor’s board members, and a Polish prosecutor may seize it and give it to an expert. “It’s here” can be checked within a week, and not by journalists.

Two possibilities remain, and neither is comfortable for the chief executive. If only Suszek knew the password, the company lost access to its reserve on March 10, 2022, at the latest, and was permanently insolvent from that day; Estonian law gives the board twenty days in such a situation to file for bankruptcy, not four years to take deposits and two to sponsor Juventus. If the CEO knows the password, one signed message ends the dispute over 4,503 bitcoins and opens the question of why he did not sign it in April. A third possibility, that the wallet exists, the key does not, and nobody is responsible, is unknown to the law. Only the narrative knows it.

Zonda, March 2026: Cleaning Out the Company a Week Before the Freeze

The contracts and books described above end in March, 2026. The exchange’s bank statements for that month, which I have described separately, show what its last weeks looked like from the side of the accounts: fourteen transfers ordered by the chief executive, totalling 501,037.80 euros; recipients with a hotel address on Lake Constance and in Łódź; an Estonian company, NGNP Digital OÜ; and, on March 27th, a V.A.T. payment of 105,410.79 euros and a transfer of 330,000 euros to the Swiss bank Sygnum. Four outside recipients received 848,163.42 euros in March, out of 2.63 million euros that passed through the euro accounts. Customer withdrawals stopped in the first days of April. Who stood first in the queue is shown by the statements, not by the support desk’s messages.

What This Means for Creditors

What follows is our assessment, not an established fact.

First, Estonia’s Bankruptcy Act allows the trustee to challenge transactions made by the debtor before the opening of proceedings, with longer look-back periods for transactions with related persons and for gratuitous ones (Section 109 and following). The ZND conversion for Jaromira W. in October, 2025, the tranches to Orion in November, 2025, and in 2026, the transfers to ZND Ventures through March, 2026, and the entire Admitrade line are candidates for such challenges. The creditors’ committee to be elected at the creditors’ meeting on September 17th should demand from the trustee a plan for each of these items, with dates.

Second, Orion and Expofer. The trustee is Orion’s sole shareholder and can replace its board with a single resolution, as we wrote alongside the trustee’s report. It is the only document in this affair that has not yet been signed. A new board of Orion is Expofer’s creditor for 254 million złotys and can pursue that claim in the Czech Republic, including in insolvency proceedings against a company that has not filed accounts for three years. This is the shortest road to the largest pile of money visible in this affair.

Third, France. The property bought in Villefranche-sur-Mer with the proceeds of the ZND conversion is an asset against which Polish prosecutors can use the same instrument with which, in July, they froze four million euros on another account in France: the European Union’s mutual recognition of freezing orders. If anyone in Katowice did not know the dates of October 8th and 9th, 2025, they know them now.

Fourth, criminal law. An agreement that lets one holder of ZND cash out at the December, 2024, price while thousands of others hold tokens worth a fraction of a cent is the textbook case that we analyzed, in the piece on the arrest of the president of the Polish Olympic Committee, under Article 302, Section 1, of the Polish Penal Code: satisfying one creditor to the detriment of the others. A credit line secured with the customers’ own money, an unsecured loan to one’s own company with interest deferred for ten years, balance adjustments without an agreement: prosecutors will also weigh each of these under the provisions on abuse of trust and money laundering, Articles 296 and 299. These are the contracts that Kral would have to explain as a crown witness, should it come to that; with every additional contract, he has more to explain and less to offer.

Fifth, the vaults. Three questions for the trustee, whose answers lie in Fireblocks rather than on the chain: who created vaults, approved transfers and sweeps after April 16, 2026, and who set the COLD vault balances in December 2024 (the system records the user, the time and the second signature for every operation); the list of 227,483 vaults with creation dates and the date of the first deposit, a ready answer to the question of how many customers paid in after the date from which, by the company’s own sheets, their deposits were not covered; and the recipients of April 19, 2026, together with the direction of the December movements in COLD. All addresses are in the annex; the trustee additionally has full access to Fireblocks and can close this in days, not months.

Sixth, the account in Zug. Two credits in June, 2023, from an account in the name of a missing man are a fact that a bank in Zug has documented down to the instruction, the device, and the I.P. address. The Estonian-Polish joint investigation team, whose creation we noted when the two investigations were merged, has the tools to ask. The answer will settle more than all the hypotheses put together. All of these items, with account numbers, bank references, transaction identifiers and vault addresses, I have gathered in an evidentiary motion on behalf of the injured parties to the National Prosecutor’s Office.

What Comes Next

The deadline for filing claims with the trustee is October 27, 2026; the creditors’ meeting sat on September 17th, and I will write about its outcome and the composition of the creditors’ committee once the minutes are in. Whoever has not filed a claim takes no part in the distribution of whatever the trustee recovers from the items described above. In parallel, the investigation in Katowice continues, in which the status of an injured party confers the right to compensation from the assets seized from the suspects. We described both tracks in our guide to recovering money from Zonda, and how much the victims can realistically expect in a separate piece. The firm files claims and criminal complaints for the exchange’s customers; details are on the page Zonda: Legal Help.

For five months, we have asked where Zonda’s customers’ money is. The answer these contracts give is not an answer to the question “where.” It is an answer to the question “to whom.” The money went to the chief executive’s company in Katowice, to his partner’s company in Tallinn, to the founder’s companies in Ostrava and in the Emirates, to people from the circle of a gas station in Czeladź, and to the sleeve of a shirt in Turin. Every one of those transfers has a contract, a signature, and a date. The exchange was a well-documented enterprise; all it lacked was an enterprise.

Robert Nogacki

Robert Nogacki is a Polish attorney at law (radca prawny), the founder and managing partner of Kancelaria Prawna Skarbiec (Skarbiec Law Firm), which has operated continuously since 2006.

The law is equal for everyone, but the parties rarely are: on one side stands an organization with time, money, and lawyers, on the other a person with one business, one nest egg, and one life.

Clients rarely come to him with a legal problem. They come with a problem that also has a legal side: an audit that began with a single invoice, money entrusted to someone who has disappeared, a company that has to be passed on before it is too late. Most such matters are decided long before the first letter is written, in decisions made without asking and in deadlines nobody remembered. So he begins by asking how the client got here, not what the client should have done.

He advises entrepreneurs and families from more than a dozen countries, including those whose accounts the tax office has just seized and who do not know what to do tomorrow morning. He defends them in tax audits, customs and fiscal inspections, disputes with the tax authorities, and criminal tax proceedings. He represents victims of investment fraud and Ponzi schemes. He helps families set up family foundations and plan succession, so that a life’s work outlasts a single generation.

Not every case can be won. Every case can be run so that the client knows where they stand. Since 2006 he has represented the victims in the WGI case (Warszawska Grupa Inwestycyjna, the Warsaw Investment Group), one of the longest criminal cases in the history of the Polish financial market, because some things must not be left half finished, even when they take two decades. In the case of the collapsed cryptocurrency exchange Zonda (Zondacrypto, operated by BB Trade Estonia OÜ), he represents several hundred victims in the criminal investigation conducted by Poland’s National Prosecutor’s Office and in the Estonian bankruptcy proceedings.

Kancelaria Prawna Skarbiec is listed in the rankings of Poland’s largest tax advisory firms published by Dziennik Gazeta Prawna and Rzeczpospolita, and it is a four-time recipient (2015 to 2018) of the European Medal awarded by the Business Centre Club and the European Economic and Social Committee. Robert Nogacki publishes regularly, in the press and on the firm’s website, for people who have a problem rather than a law degree, because a legal opinion the client cannot understand protects only the lawyer.

He believes that the best legal advice is the kind that means the client never has to appear in court.