Zondacrypto: How Customers Lost Their Money. New Findings
The Premium Was the Bait. What the Ethereum ledger says about the last days of the ZND token.
Kancelaria Prawna Skarbiec · Robert Nogacki, attorney at law · July 20, 2026
A Gap That Shouldn’t Exist
Picture a trader at his screen on an April evening, toggling between two tabs. In one, the ZND token, the house currency of the Polish crypto exchange zondacrypto, is trading on KuCoin, a large international venue where the token was listed in April of 2025; the token had traded off its home exchange since its debut in October of 2024, on MEXC and BitMart among others, and joined Gate.io on March 3, 2025, the venue participants recall as its main external market for much of that year. In the other tab, the same token trades on zondacrypto itself. The two numbers should be nearly identical. They are not. At first the gap is twenty to thirty per cent. Then fifty. In the final weeks it widens to a point where the price on the exchange that issued the token is double, triple, five times the price everywhere else. And, strangest of all, it is the home price that is rising.
In a functioning market, a gap like that has a life expectancy of minutes. Arbitrage closes it: you buy where it’s cheap, move the token to where it’s expensive, sell, withdraw the difference. The mechanism has one requirement, so obvious that nobody thinks to state it. All the doors have to be open. On zondacrypto, in April of 2026, only the entrance was. Deposits worked. Withdrawals, as we documented in real time, for the great majority of customers did not.
This is the heart of the matter, and it deserves to be said plainly. A price premium on an exchange from which money cannot leave is not a market signal. It is bait. A rational investor who sees a fifty per cent spread between venues does exactly what the textbook teaches: buys cheap, wires in fresh, liquid funds to seize the opportunity. The accounts now reaching our firm repeat the same pattern, with the monotony of a stencil. New stablecoin deposits flowed into zondacrypto until the last days, drawn by a premium that could no longer be cashed. The exchange’s chief executive, meanwhile, was publicly assuring customers that the withdrawal problems were temporary and technical. If the premium was engineered, then the people who chased it did not make an investment error. They behaved precisely as the mechanism’s designer anticipated. Schemes built this way defeat the people who understand markets best, because it is their reflexes that have been priced in.
The divergence, moreover, was not confined to ZND. In the final weeks, according to participants, prices came apart on virtually every asset the platform offered, only in the opposite direction: Bitcoin traded on zondacrypto at roughly twenty per cent below the world price, a gap the trade press noted at the time, and discounts on other major pairs reached thirty per cent. The directions resolve into a single mechanism. Assets trapped on the platform got cheaper, because balances that cannot be withdrawn stop being equivalent to outside money; ZND got dearer, because its ERC-20 withdrawals were still clearing on-chain, which made its premium, in effect, the price of the last open door. For the legal analysis the distinction is secondary: any spread on an exchange without withdrawals pulls fresh value in from outside, whether the lure is a premium on the house token or a thirty per cent discount on Bitcoin, and the class of people misled includes everyone who deposited funds chasing any of these gaps.
Traders in the order book reported one more thing, a detail that in April looked like a curiosity and is now the spine of the case: on the Ethereum blockchain, ZND could be seen leaving the exchange, regularly, for deposit addresses at KuCoin, where large sell orders kept appearing and pressing the external price down. Which brings us to the ledger itself.
Ninety-Nine Million Tokens in Eleven Days
In an earlier piece about ZND, I described what the token actually is: an ERC-20 smart contract, two substantive lines of code, seven hundred million units conjured for the cost of a network fee, with a white paper draped over the top. That essay ended on the question of what was in the can. This one begins with a harder question: what happened to the cans in the weeks before the shop closed.
The token lives at the contract address 0x2d8eA194902Bc55431420BD26Be92b0782dCe91D. The wallet that Etherscan labels Zonda 5, at 0x6edf968da408a9640b8865826429a977a11c5048, served as the exchange’s main hot wallet for ZND. Our firm reconstructed its outflows directly from Etherscan’s public transaction filter, independently of the earlier investigation by the forensic firm Recoveris. What follows is certain in the strictest available sense: anyone with a browser can replicate it.
Between April 5 and April 15, 2026, the Zonda 5 wallet sent out 174 transfers of ZND, totalling 99,015,971 tokens. After April 15 the outflows stopped, and the wallet was left holding roughly 100,704 ZND, worth, at the prevailing price, about eight dollars. A wallet that serviced the house token of one of Central Europe’s best known exchanges was drained to functional zero in eleven days.
The destinations are more eloquent than the volume. Deposit addresses at KuCoin, counting both directly labelled addresses and intermediaries funded by KuCoin’s own infrastructure, absorbed about 87.5 million ZND, or 88.4 per cent of everything that left. Gate.io took 4.6 per cent, addresses funded by MEXC another 2.2 per cent, and a scattering of unlabelled wallets the remainder. The four largest KuCoin deposit addresses alone received more than eighty-six million tokens across just twenty-nine transactions: 0xc23b7e…4109, 0x1ba7c3…2c2e, 0xd1ce2c…3f10, and 0x0a86ed…ad99. The three most active Gate.io deposit addresses were 0x0d9279…2a1c, 0xef0d5f…a0c7, and 0x91e67b…60fe, and the largest intermediary address, gas-funded from the MEXC 19 wallet, was 0x31866e…b4cb. Each link opens the address’s full public history on Etherscan. The pattern, incidentally, was first spotted by users themselves, who flagged the first of these deposit addresses on X before any forensic report confirmed it. The timing was as concentrated as the routing: two thirds of the volume moved in the first three days, April 5 through 7, and ninety-four per cent by April 10. A methodological caveat: explorer labels are attribution leads, not proof of beneficial control, which is why I treat them as the starting point for subpoenas rather than as a conclusion. Recoveris, which mapped the exchange’s wallet clusters across six blockchains, reports one further finding: assets flowing the other way, USDC, ETH, and other liquid instruments returning from KuCoin toward wallets attributed to the exchange. That finding comes from an outside report and has not been published at the level of individual transaction hashes, so I classify it as probable rather than certain.
Now lay the calendar of public statements over this chart. On April 5 and 6, Polish media published an analysis showing that the exchange’s Bitcoin reserves had collapsed; April 5 was also the single largest day of ZND outflows, more than thirty-three million tokens. On April 6, the chief executive called the analysts’ findings a fundamental error and promised that withdrawals would resume by April 12. On April 8, Poland’s National Prosecutor’s Office opened an investigation. On April 10, ZND fell 29.63 per cent in a single day, on record volatility; it was also the peak day for transaction count out of Zonda 5. April 12 came and went; withdrawals did not return. On April 14, the chief executive wrote publicly that investing customer funds should not be confused with liquidity management, that is, with market making. By the time he posted it, the wallet was ninety-four per cent empty, and the exchange’s own terms of service, from July of 2025, stated flatly that the exchange does not speculate and is not a market maker. One cannot contractually disclaim market making to one’s customers and then invoke it as a public defense after the fact.
What the Forensic Literature Says
To judge whether this picture fits known patterns, it helps to consult a body of research that has spent the past several years measuring crypto market manipulation with the tools of forensic finance.
The classic mechanics of the pump and dump I covered in the earlier essay: studies by Gandal and colleagues, by Xu and Livshits, and by Clough and Edwards have catalogued thousands of orchestrated pumps and documented their long term signature, which is the durable destruction of the pumped asset’s value. Here it is worth adding two pillars that fit the ZND case more closely.
The first concerns wash trading, the practice of an entity trading with itself to fabricate volume and price. Cong, Li, Tang, and Yang, in Crypto Wash Trading, published in Management Science in 2023, examined twenty-nine centralized exchanges using the statistician’s equivalent of a lie detector: first-digit distributions, order-size rounding, the shape of transaction tails. On regulated exchanges, trading looked the way trading looks everywhere in nature and finance. On unregulated ones, fabricated volume averaged more than seventy per cent of what was reported. The authors also documented the motive: fake volume lifts an exchange’s ranking and temporarily distorts prices. An exchange with total control of its own order book and no external supervisor has, in other words, both the means and the incentive to make the numbers on its screen say whatever is useful.
The second pillar concerns what a single determined actor can do to a price. Griffin and Shams, in Is Bitcoin Really Untethered?, published in the Journal of Finance in 2020, sifted more than two hundred gigabytes of blockchain data from the 2017 boom and showed that purchases made with freshly issued Tether, attributable to one entity, systematically followed market downturns and lifted the price of Bitcoin. The methodological lesson for the ZND case is direct: single-actor manipulation can be demonstrated on public data, from timing patterns and address clustering, before any prosecutor ever subpoenas an exchange’s internal records.
And there is a structural precedent, though with the vector reversed. In the FTX case, the S.E.C. alleged that Caroline Ellison, at Sam Bankman-Fried’s direction, bought large quantities of the FTT token on the open market to prop up its price, because FTT served as collateral for undisclosed loans made out of customer funds. There, the house token’s price was inflated to overstate collateral on a balance sheet. In the ZND case the hypothesis is the mirror image: a price kept high on the home venue attracted fresh deposits, while supply was dumped on an external venue in exchange for liquid assets. The common denominator is the same in both constructions. The exchange’s own token is a lever, and the issuer pulls it in whichever direction the moment requires. It bears remembering that analyses of BB Trade Estonia’s financial statements, the Estonian company behind the exchange, found that ZND’s positive contribution to the bottom line exceeded the firm’s entire net profit for 2024; without the token, the company would have posted a loss. The price of ZND was not an ornament. It was a line item.
Two Hypotheses
Fairness requires putting the strongest counterargument before the thesis, because an innocent explanation for the premium exists and deserves a serious hearing.
The first hypothesis is the market one: the premium may have arisen on its own, with no hand on the order book. When withdrawals stop, an exchange becomes a sealed vessel. Users who cannot get their money out begin trading it among themselves inside the vessel; balances trapped on the platform lose their connection to outside money and start pricing assets in a private currency of hope. The phenomenon is familiar from the history of insolvencies, where prices on a dead platform can rise precisely because no one can take a profit. The heavy supply on KuCoin, meanwhile, could have come from presale investors, from vesting beneficiaries, or from ordinary holders fleeing a sinking project. In this version, the premium is a symptom of the disease, not an instrument of a crime.
The second hypothesis is the manipulation one: the premium and the external supply were two halves of a single operation. Whoever controlled the exchange’s hot wallet sent ZND to KuCoin and liquidated it there for USDC and ETH, while on its own sealed order book it maintained, or tolerated, a price several times higher, which worked as flypaper for arbitrageurs and their fresh stablecoins. In this version, every element has a job. The low external price is the exhaust of the dumping; the high internal price is the lure; the frozen withdrawals are the wall against which every attempt to close the arbitrage shatters.
What lets us weigh the two? Honestly, less than the routing concentration alone would suggest, because an intermediate variant also explains it: one or a few large customers could have been buying ZND with balances trapped on the platform, withdrawing the token to their own KuCoin accounts, since those withdrawals still worked, and selling it there below the market so as to stand first in the book. Four deposit addresses may be as few as four accounts. Concentration by itself, then, settles nothing. Two other elements do. The first is tempo and closure: ninety-four per cent of the volume in six days, then silence and a wallet drained to eight dollars, with none of the inventory replenishment that marks genuine market making. The second, and weightier, is the direction of the return flows: if the Recoveris findings of USDC and ETH moving from KuCoin back toward exchange-attributed addresses hold up, the rescue variant collapses, because a customer saving his own funds does not wire the proceeds back to a sinking platform. And one more thing must be said: even in the rescue variant, the operator is neither innocent nor out of pocket. It keeps the deposited stablecoins and fiat, ships out its own token in return, and it was the operator who decided that this one door, alone, would stay open. The final answer sits in records the blockchain does not contain: the know-your-customer files behind the KuCoin accounts, and the order histories on both sides.
Epistemic honesty demands a clean partition all the same. It is certain that tokens left a wallet attributed to the exchange for KuCoin deposit addresses at the scale, concentration, and sequence described; that stands on the chain. It is probable that those tokens were sold on KuCoin and that the returning liquid assets were the proceeds; direction, timing, and the external report point that way. It remains unestablished who controlled the KuCoin account, who placed the large sell orders visible in its book, and whether anyone on the zondacrypto side actively propped the internal price. The blockchain ends at the deposit address; beyond it begins KuCoin’s internal ledger, to which the only key is held by law enforcement, through subpoenas, mutual legal assistance, and, as regards the exchanges’ EU-established entities, the European Investigation Order. That is precisely the material the criminal investigation should now demand: the identity of the account holder behind the deposit addresses, the complete order history including cancellations, IP and API-key logs, the stablecoin withdrawal history, and any documentation of KuCoin’s relationship with the issuer.
Where the Money Went
The question every victim asks is the simplest one: where is the money? Today’s answer has three floors of certainty.
The first floor is on-chain. Ninety-nine million ZND left the exchange’s wallet, nearly nine tenths of it for KuCoin deposit addresses. In parallel, according to Recoveris, between mid-December of 2025 and early April of 2026, the exchange’s wallets sent 511 transfers, worth about twenty-one million dollars, in thirty assets across six blockchains, to a single deposit address at Kraken; the monthly volume of those transfers correlated at 0.92 with the volume of withdrawal complaints. The report also notes that about 772,000 USDC received by the exchange on April 7 reached that same Kraken address within forty-eight hours. These figures come from an outside report and await verification in the proceedings, but the direction is consistent: liquid assets were leaving the exchange’s infrastructure through channels that do not look like customer withdrawals.
The second floor is inside the exchanges. What happened to the ZND after it landed at KuCoin, and to the assets after they landed at Kraken, is known only to those venues’ internal ledgers. Both operate in jurisdictions that answer legal-assistance requests; both run know-your-customer programs. The trail does not go cold. It merely changes medium, from a public ledger to a subpoenaable one.
The third floor is the asset map. The group’s structure, which we have described before, with an operating company in Estonia and a holding company in Switzerland, marks out the jurisdictions where asset freezes are possible. The pace will be set not by any lawyer but by the diligence of authorities in several countries at once. Anyone promising otherwise is, in all likelihood, the next link in the chain of fraud, this time of the recovery variety.
From MiCA to the Criminal Code
The European Union’s Markets in Crypto-Assets Regulation, MiCA, prohibits market manipulation in Article 91, and its catalogue reads like a description of the pattern above: transactions giving false or misleading signals as to supply, demand, or price; trading with oneself; disseminating misleading information. Maintaining a price on one’s own platform detached from the external market while dumping supply onto that market would, if attributed to a specific actor, fit the catalogue like a template. The enforcement problem is that as of July 1, 2026, with the Estonian license expired and Poland still lacking a competent authority for MiCA, administrative enforcement against this operator hangs in a vacuum. Which shifts the full weight onto criminal law.
Under the Polish Criminal Code, the matter arranges itself into three provisions. Two of them, Article 286 § 1 and Article 299, already appear in public reporting on the investigation; the third enters the case through the victims’ criminal complaints. Article 286 § 1, the fraud provision, in conjunction with Article 294 § 1, which covers property of significant value: if the price divergence, the ZND premium or the seeming discount on any other pair, was engineered or knowingly sustained as bait, then everyone who wired fresh funds onto a platform with failing withdrawals under its influence was deceived about the one fact that mattered, the possibility of realizing a gain and recovering capital, and induced into a disadvantageous disposition of property. This carves out a new and so far barely visible class of victims: people whose loss is not the token’s price decline but the entire deposit, wired in pursuit of an arbitrage that could never be closed. Article 284 § 2 covers misappropriation of entrusted assets, if customer funds were used for operations the exchange’s own terms expressly forbade. Article 299, the money-laundering provision, closes the construction from the flow side: multi-hop transfers through intermediary addresses to accounts at external exchanges, conversion into liquid assets, and onward extraction are the textbook object of a laundering inquiry.
One warning is owed to the people who traded ZND during the price divergence, the arbitrageurs above all. Exploiting real price differences with your own capital, carrying risk on both legs, is lawful arbitrage and nothing more; manipulation means fictitious orders, self-dealing, fabricated signals. But it should be understood that in a manipulation investigation, every significant participant in the order book gets examined, with no roles presumed in advance. Observations from the book, screenshots, order-history exports, and notes should therefore be preserved intact and handed to counsel or to law enforcement, not posted to Telegram groups and forums, where they will be stripped of context before anyone has a chance to classify them correctly.
Instead of a Conclusion
In 1961, Piero Manzoni sold sealed cans whose contents were part of the joke, and balloons filled with his own breath; everyone was in on it. The ZND ledger records something the joke never anticipated. Over eleven days, someone carried ninety-nine million cans out of the warehouse through one door, while above the other door glowed an illuminated sign quoting a price five times higher than anywhere else on earth. Who had a hand on the switch is for the criminal courts to establish. That the sign was lit while the warehouse emptied, at the same hour, we know already, and we know it from a register that cannot be rewritten.
Anyone harmed in connection with zondacrypto, including those who deposited funds during the ZND price divergence, is welcome to contact the firm; we maintain a full compendium of the case at kancelaria-skarbiec.pl/en/zondacrypto.
Legal and factual status as of July 19, 2026. Findings marked as originating in external reports have not yet been verified in the proceedings.
Robert Nogacki – licensed legal counsel (radca prawny, WA-9026), Founder of Kancelaria Prawna Skarbiec.
There are lawyers who practice law. And there are those who deal with problems for which the law has no ready answer. For over twenty years, Kancelaria Skarbiec has worked at the intersection of tax law, corporate structures, and the deeply human reluctance to give the state more than the state is owed. We advise entrepreneurs from over a dozen countries – from those on the Forbes list to those whose bank account was just seized by the tax authority and who do not know what to do tomorrow morning.
One of the most frequently cited experts on tax law in Polish media – he writes for Rzeczpospolita, Dziennik Gazeta Prawna, and Parkiet not because it looks good on a résumé, but because certain things cannot be explained in a court filing and someone needs to say them out loud. Author of AI Decoding Satoshi Nakamoto: Artificial Intelligence on the Trail of Bitcoin’s Creator. Co-author of the award-winning book Bezpieczeństwo współczesnej firmy (Security of a Modern Company).
Kancelaria Skarbiec holds top positions in the tax law firm rankings of Dziennik Gazeta Prawna. Four-time winner of the European Medal, recipient of the title International Tax Planning Law Firm of the Year in Poland.
He specializes in tax disputes with fiscal authorities, international tax planning, crypto-asset regulation, and asset protection. Since 2006, he has led the WGI case – one of the longest-running criminal proceedings in the history of the Polish financial market – because there are things you do not leave half-done, even if they take two decades. He believes the law is too serious to be treated only seriously – and that the best legal advice is the kind that ensures the client never has to stand before a court.
