Two Chief Executives Vanished. Poland’s Biggest Crypto Exchange Vanished With Them

Estimated reading time: 14 minutes

Reporters for The New York Times went looking for Zondacrypto’s headquarters this summer. They found a modest second floor outside Tallinn. A kitchenware shop occupied the ground floor. A nail salon sat next door. The lobby mailbox had filled up over months, and nobody had emptied it. Salon staff could not recall anyone entering the office at all.

That address served a company claiming more than a million customers across Europe. It held an Estonian license for almost six years. It sponsored the Polish Olympic Committee and football clubs in three countries.

What we are trying to establish

This account answers three questions, and marks the evidence for each one. How did Zondacrypto actually operate? Why did it stop? What happened to the two men who ran it?

We separate three categories throughout. Blockchain records and official filings carry the label documented. Company statements carry the label claimed. Political accusations without filed charges carry the label alleged. That distinction matters more here than in almost any story we have covered.

How the exchange actually worked

Zondacrypto ran a custodial exchange. Customers sent zloty, euro or pounds, and the platform held those funds. Customers then traded roughly 50 coins and tokens against those currencies. The exchange controlled the private keys throughout.

That model creates one obligation above all others. The operator must keep enough assets to honour every withdrawal request. Exchanges normally park day-to-day flow in hot wallets and store the bulk in cold storage.

Zondacrypto added its own token, called ZND, plus a payments arm and a fiat exchange. It also built a payment gateway through an affiliated group, Femion Technology, and its subsidiary TryPay.

From Katowice to a national brand

Sylwester Suszek founded the platform in 2014 in Katowice, the heart of Poland’s coal region. He named it BitBay. Polish media called him the crypto king. He was a miner’s son, and he was 26.

BitBay grew into the largest cryptocurrency exchange in Central and Eastern Europe. Most of its customers lived in Poland. For years it looked like the region’s clearest crypto success story.

The 2018 warning that moved the address

Poland’s Financial Supervision Authority placed the platform on its public warning list in 2018. The regulator suspected unauthorised payment services. Suszek then went looking for a friendlier jurisdiction.

Malta refused him. Estonia did not. In October 2020 the business registered as BB Trade Estonia OÜ, and the brand became Zondacrypto.

What an Estonian license actually covered

Estonia sold thousands of virtual currency licences during the previous decade. The country’s Financial Intelligence Unit supervised holders under anti-money-laundering law. That mandate has a narrow shape, and the gap matters enormously here.

The FIU checks whether a company’s documentation meets statutory requirements. It does not verify that customer funds exist. It does not audit custody. Estonian supervision therefore ran, for years, mainly on paper.

The scale of the clean-up shows the earlier laxity. Estonia held 641 valid licences in mid-2021. By the start of 2026 only 36 survived.

March 2022: the founder drives to a fuel depot

On 10 March 2022 Suszek drove to a business meeting near Katowice. The meeting took place at a fuel depot in Czeladź. He was 34 years old. Nobody has seen him since.

His family soon received ransom demands payable in bitcoin. His sister later received a voicemail and gave it to investigators. In it Suszek pleaded for help, and said bitcoin would free him. His family now assumes the worst.

The associate who vanished next

Prosecutors charged a close business associate of Suszek, the man who ran the depot. The charges covered organised crime membership, large-scale VAT fraud, money laundering and unlawful deprivation of liberty.

He disappeared after prosecutors filed those charges. Poland therefore lost the founder and the main suspect in the same case.

The lawyer takes the wheel

Suszek sold the exchange in 2021, shortly before he vanished. His lawyer, Przemysław Kral, took control. Kral lived in Monaco and ran the business from there.

Kral spent heavily on visibility. He funded football clubs in Poland, Italy and Estonia. He signed the Polish Olympic Committee as general sponsor for 2026 to 2028. In January 2026 the brand appeared on a hockey team at Davos.

Estonian auditors meanwhile raised a separate question. They doubted whether the assets shown in the 2023 and 2024 financial statements existed at all.

December 2025: the first complaints

Customers began reporting delayed withdrawals on the exchange’s Polish-language Telegram channel in December 2025. Complaints increased steadily through January 2026. Administrators blamed high demand and new security procedures.

One detail stood out immediately. The same complaints never appeared on the global or Italian-language channels. That asymmetry pointed at a Polish liquidity problem rather than a platform-wide technical fault.

A test withdrawal that never cleared

Recoveris, a Swiss-registered blockchain forensics firm, decided to test the platform directly. Its team placed withdrawal orders in late March 2026. Small orders cleared normally.

A larger bitcoin withdrawal, placed on 1 April, sat pending for more than fourteen hours. The exchange then cancelled it. Zondacrypto had already paused two fiat withdrawal routes, citing technical problems, without any formal statement.

The hot wallet that emptied

Recoveris then examined the public ledger across six blockchains. The firm reviewed roughly one million addresses and used seven analytics providers. The result arrived in under 24 hours.

The monthly average balance on Zondacrypto’s main labelled bitcoin cluster had collapsed. It fell from 55.7 BTC in August 2024 to 0.18 BTC in March 2026. That represents a decline of 99.7 percent.

The daily balance stayed below 1 BTC on every single day of March 2026. On 27 of those 31 days it stayed below 0.5 BTC. On 1 April the balance read 0.086 BTC, worth roughly 9,700 dollars.

How the peers compared

A low hot-wallet balance proves nothing on its own. Exchanges legitimately keep most customer assets in cold storage. Recoveris said so explicitly in its own analysis.

The comparison still carries weight. Recoveris found that European exchanges of comparable size held an average of 308 BTC in their main hot wallets. The range ran from 50 to 600 BTC.

One benchmark cuts through everything else. Kuna, an exchange operating from a country at war, held roughly 10 BTC. Zondacrypto held less than a hundredth of one bitcoin.

511 transfers to one Kraken address

The second finding traced where assets went. Between mid-December 2025 and 2 April 2026, Recoveris identified 511 transfers from Zondacrypto wallets to one Kraken deposit address.

Those transfers totalled roughly 21 million dollars, or about 76 million zloty. They spanned 30 different assets and crossed all six analysed chains. That pattern indicates systematic movement rather than a single technical operation.

A correlation of 0.92

Recoveris then compared two series. It measured monthly stablecoin flows to that Kraken address against the volume of user complaints on Telegram. The two moved almost in lockstep.

The Pearson correlation coefficient reached 0.92. Correlation never proves causation. At that strength, however, it demands an explanation, and the exchange never offered one.

6 April: publication day

The Polish outlet money.pl published the analysis on 6 April 2026. Twenty-two days later the exchange had gone dark. Its chief executive had left the country. Prosecutors had opened a criminal case.

The response on 7 April deserves attention. Zondacrypto’s Ethereum hot wallet received two large deposits totaling roughly 1,152,732 USDC. Somebody topped up the wallet the day after publication.

Eight hops, two minutes apart

The route those funds took looked unusual. The value started as USDT, then swapped to USDC on the 1inch decentralised exchange. It then moved through eight sequential single-use addresses.

Each intermediate address handled exactly one inbound and one outbound transfer. None had any other history. The intervals ran short and regular, around two minutes apart.

Anti-money-laundering practitioners call that pattern layering. Recoveries labelled it as such, while stating plainly that it could not identify the original source.

Three days of numbers, then silence

Zondacrypto responded to the coverage by publishing daily withdrawal totals. It kept that up for three days, then stopped.

Recoveries cross-checked those three days against the ledger. The figures reconciled only when the analysts excluded the Kraken transfers. That arithmetic implies the exchange itself controlled that Kraken address, rather than its customers. Zondacrypto never answered when asked to confirm or deny ownership.

The eighteen-minute video

Kral addressed customers on 16 April in an eighteen-minute video on X. He displayed a wallet address holding roughly 4,500 bitcoin and he valued it above 330 million dollars.

He then delivered the sentence that defines this case. The company could not access the private keys. Only Suszek had held them, and Suszek had disappeared four years earlier.

A wallet dormant since 2016

Analysts checked the address within minutes. It had sat dormant since 2016. It showed no visible on-chain connection to any known Zondacrypto or Suszek wallet.

A wallet nobody can move functions, for every practical purpose, as an empty one. Zondacrypto also refused to publish any cold wallet addresses, citing the EU’s MiCA and DORA rules. Neither regulation prohibits that disclosure, and major exchanges publish proof of reserves routinely.

The board walks out, the site goes dark

The exchange’s own deadline to resume withdrawals expired on 17 April. Withdrawals stayed frozen. The chief compliance and anti-money-laundering officer resigned.

The entire supervisory board of BB Trade Estonia OÜ then resigned. The directors cited material inconsistencies between public statements and operational reality. Kral signed a farewell statement to staff on 21 April.

On 23 April zondacrypto.com went offline. Somebody shut down the corporate email and the company Slack workspace on the same day.

The second disappearance

Kral last communicated publicly on 16 April 2026. He has not surfaced since. Reports place him in Israel, Botswana and Dubai, and none of those sightings carry confirmation.

The New York Times published its investigation on 23 August 2026, under a headline naming both vanishings. Andrew Higgins, its Central Europe bureau chief, reported from Katowice, Warsaw and Tallinn.

Estonia pulls the license, two days before MiCA

Estonia’s FIU partially suspended licence FVT000209 on 18 May 2026. The order barred new clients and new deposits, while leaving withdrawals permitted. Withdrawals never resumed anyway.

The company ignored the supervisory precept. On 29 June the FIU revoked the licence outright, ending an authorisation held since October 2020.

The timing carries real significance. Article 143 of MiCA let firms operating under old national regimes continue only until 1 July 2026. Zondacrypto’s Estonian licence died two days before that deadline.

What prosecutors have secured

The Katowice regional prosecutor opened the case on 17 April 2026, under Poland’s fraud and money laundering articles. The initial damage estimate reached at least 350 million zloty. The originally assigned prosecutor recused himself within hours, citing prior cooperation with the exchange.

An Estonian court barred BB Trade Estonia from disposing of assets on 27 July, and appointed an interim trustee. Prosecutors froze 4 million euro in a French bank account. Investigators seized 104 devices and more than 13 terabytes of data from Polish servers.

The scandal becomes Polish politics

Prime Minister Donald Tusk addressed the Sejm on 17 April. He argued that the exchange’s rise began with the money of the Russian mafia. He also invoked Russian security services and Polish right-wing politicians.

Those statements remain political assessments. No prosecutor has filed charges alleging Russian state involvement. We flag that gap deliberately, because the claim now shapes Polish coverage of the case.

Three vetoes and a crypto bill

Poland still lacks a domestic crypto-asset law. President Karol Nawrocki vetoed the government’s regulation bill three times, in December 2025, February 2026 and June 2026.

The president argued that the bill threatened citizens’ freedoms and would push Polish firms abroad. The government argued that the vacuum left consumers exposed to unscrupulous operators. Zondacrypto collapsed inside exactly that vacuum.

August: a defence lawyer and a vast fortune

Roman Giertych announced on 25 August that he had defended Kral since May. Giertych sits in parliament for Tusk’s Civic Coalition and has acted for the Tusk family.

He stated that Kral had placed a vast fortune at the prosecutors’ disposal. Combined with earlier seizures, he argued, it should satisfy every registered victim. Prosecutors have not publicly confirmed that assessment.

Reports describe earlier meetings abroad between a senior prosecutor, Kral and his lawyers, in Gulf states and in Sicily. Nobody recorded those meetings as formal interviews.

The prosecutor general’s breakthrough

Justice Minister Waldemar Żurek announced a breakthrough on the same day. Investigators are now examining financial flows from Zondacrypto towards politicians and connected entities.

The named recipients include foundations linked to Zbigniew Ziobro and Przemysław Wipler. They also include the broadcaster Republika, CPAC Poland, and Olympic Committee president Radosław Piesiewicz.

The opposition’s counter-argument

Ziobro confirmed that his foundation received 450,000 zloty from Kral’s law firm. He said the sponsorship machinery had created the appearance of a large, lawful business, he added that he refused further money once doubts emerged.

He also accused the government of treating Kral leniently because Kral had become politically useful. This is the desperation of a regime fighting for its own future impunity, he said.

Republika’s head, Tomasz Sakiewicz, noted that Zondacrypto advertised across many outlets. He argued that Kral will now say whatever serves his own position.

What victims can do now

Prosecutors had received several thousand criminal notifications by late July. They estimate losses of at least 350 million zloty, roughly 81 million euro. The investigation now runs until 17 January 2027.

Lawyers advise two immediate steps. File a written demand for the return of funds with the operating entity, and keep proof of receipt. Then file a criminal notification, and copy the venue connected to the documented flows.

The supervision question Europe has not answered

Zondacrypto exposes a structural gap rather than a Polish or Estonian failure. An anti-money-laundering regulator checks paperwork. Nobody in the old national regime verified that customer assets existed.

MiCA closes part of that gap, and Estonia’s own head of supervision has said as much. Supervision must now cover asset safeguarding and cyber resilience, not documentation alone. The transition arrived roughly eighteen months too late for Zondacrypto’s customers.

What we still do not know

Three questions remain genuinely open. Nobody has established what happened to Sylwester Suszek, nobody has confirmed where Przemysław Kral is now. Nobody has verified whether the 4,500 bitcoin ever existed.

A fourth question will determine whether victims recover anything. Prosecutors must identify which wallets held customer assets, and who controlled them. The ledger holds that answer, and it does not forget.