What three weeks of public-ledger analysis, journalist coordination, and real-time monitoring revealed about an EU-based VASP crypto exchange, and what it shows about the limits of “trust me” in the tokenized economy.
On April 6, 2026, money.pl published an investigation built on Recoveris’s on-chain analysis of Zondacrypto, one of the oldest and most popular among Poles crypto exchanges. Twenty-two days later, Zondacrypto’s website was offline, its CEO had reportedly left the country, the Polish government had held a press conference at the Prime Minister’s Office, and the Prosecutor’s Office had opened a criminal investigation with damage estimates climbing into the hundreds of millions of USD.
This article is a structured recap of what the investigation actually involved, how the case unfolded after publication, and what we believe it demonstrates about transparency, communication, and the role of forensic analysis in keeping markets honest.
The first signals (late March 2026)
Two independent streams converged before any analytical work began.
The first was public. Complaints about delayed or blocked withdrawals had appeared sporadically on Zondacrypto’s official Polish-language Telegram channel as far back as December 2025, then increased steadily from January 2026 onwards. The same complaints did not appear on the exchange’s global or Italian-language channels, where Zondacrypto also maintained a market presence. The asymmetry itself was a signal.
The second was internal. Members of our team placed test withdrawal orders on the exchange. Smaller orders went through. A larger BTC withdrawal, initiated on April 1, remained in “pending” status for over fourteen hours and was eventually cancelled. By that point, Zondacrypto had paused withdrawals through ZEN.com and SEPA Instant CJ, citing “technical problems,” with no formal corporate communication, no official statement, no press release. The only acknowledgements were informal replies from administrators on Telegram.
When public complaints, an absent corporate response, and a stuck internal test all align, the analytical question becomes specific: what does the public ledger show, and does it match the exchange’s narrative?
What we did
Recoveris ran three parallel streams of inquiry, each cross-checking the others.
The on-chain stream traced flows across six blockchains (Bitcoin, Ethereum, Polygon, Arbitrum, Avalanche, Optimism), reviewing Zondacrypto’s wallet clusters as labelled by the major analytics providers and looking for outflows to cold storage or external venues. Approximately one million addresses were reviewed in total. We use seven different blockchain analytics providers in combination with our own attribution database, which gives us unprecedented advantage, even above top-tier law enforcement agencies.
The off-chain digital stream involved continuous scraping of Zondacrypto’s official Telegram channel from December 2025 onwards, monitoring of user reports on X, and tracking of the exchange’s own communications over time.
The field-intelligence stream came from industry events and direct conversations within the Polish crypto community: withdrawn sponsorships, unpaid invoices to event organisers, weak presence at conferences where the exchange would normally be visible.
None of these was a smoking gun on its own, but when combined and recurring, it was an alarm signal.
The findings that drove publication
Three on-chain observations stood out.
First, the BTC hot-wallet balance. The monthly average on Zondacrypto’s main labelled BTC cluster fell from a peak of 55.7 BTC in August 2024 to 0.18 BTC in March 2026, a 99.7% decline. Through every single day of March 2026, the daily balance stayed below 1 BTC. For 27 of those 31 days, it stayed below 0.5 BTC. The balance on April 1, 2026 was 0.086 BTC, equivalent to roughly $9,700.
For context, peer European exchanges of comparable size held an average of 308 BTC across their main BTC hot wallets, in a range of 50 to 600 BTC: Coinmate, WhiteBit, Bitvavo, Kanga, Bitpanda. Even Kuna, an exchange operating from a country in active armed conflict, held roughly 10 BTC.
Second, the flows to a single Kraken-controlled deposit. Between mid-December 2025 and April 2, 2026, we identified 511 transfers from Zondacrypto wallets to one specific Kraken deposit address, totalling approximately $21M (roughly 76M PLN). The transfers spanned thirty different assets and crossed all six analyzed chains, indicating systematic movement rather than a single technical operation. A second-order analysis showed that the monthly USDT and USDC flows from Zondacrypto to that Kraken deposit moved almost in lockstep with the volume of user complaints on Zondacrypto’s Telegram channel. The Pearson correlation coefficient between the two series was 0.92. Correlation is not causation, but at that strength it is a serious red flag.
Third, the absence of any verifiable counter-evidence. Exchanges normally use hot wallets only to handle day-to-day deposit and withdrawal flow, while the bulk of customer assets is held in secure cold storage. A low hot-wallet balance, taken in isolation, does not establish insolvency. Zondacrypto could in principle have held its reserves in cold wallets outside any labelled cluster, and our analysis explicitly acknowledged this. The relevant test is therefore not what the hot wallet shows on a given day, but whether an exchange asked to demonstrate its cold reserves can actually do so. Blockchain technology makes that demonstration uniquely simple: an exchange can publish wallet addresses or implement Proof of Reserves, as Binance and other major venues do, with regular audits by firms such as Hacken. Zondacrypto did neither, before or during the crisis. When asked, the exchange’s CEO stated that the company held over 4,500 BTC in undisclosed cold wallets with multiple custody providers, but declined to provide addresses, custody-provider names, or any verifiable evidence, citing DORA and MiCA. Both regulations require transparency obligations, and neither prohibits disclosure of public wallet addresses.
We presented the findings as facts on what is visible on the ledger and what is not, and offered three alternative explanations for the observed patterns: liquidity stress, response to a security incident, or wallet reorganisation. The conclusion of the analysis was not that Zondacrypto was insolvent. The conclusion was that the on-chain picture was inconsistent with the exchange’s public posture, and that the exchange itself held the simple tools to resolve the question.
Speed by design
From the moment the on-chain signals consolidated to publication-ready analysis, the elapsed time was under 24 hours. Recoveris’s positioning is built on this. We combine custom analytics aggregation across the seven providers, a proprietary monitoring platform that flagged the post-publication inflows in real time, an in-house AI agent trained on our casework, and a team of former law-enforcement officers and forensic specialists with direct experience on cases of comparable scale, including Quadriga, Bitcurex, and Bitmarket. This is the operational tempo the tokenized economy actually requires, and it is the gap where most exchanges and most regulators currently struggle.
After the article: a one-day response and an unusual on-chain pattern
On April 7, the day after publication, Zondacrypto’s Ethereum hot wallet received two large USDC deposits totalling approximately 1,152,732 USDC, around 4.2 million PLN. We monitored the inflows in real time.
The path of the funds before they reached the exchange was unusual. On both transfers, the value originated as USDT, was swapped to USDC on the 1inch DEX, and then moved through eight sequential single-use addresses on Ethereum before arriving at Zondacrypto’s hot wallet. Each intermediate address handled a single inbound transfer and a single outbound transfer, with no other history. The intervals between hops were short and regular, around two minutes. The pattern, a fixed number of hops, regular intervals, single-purpose intermediate addresses, and an asset swap at the start of the chain, is not characteristic of normal user activity or a typical hot-wallet top-up by an exchange. It may, but does not necessarily, indicate deliberate effort to obscure the original source of funds. AML practitioners call this layering. We labelled it as such, with the disclaimer that we could not identify the original source.
What happened next was the more relevant finding. Within 48 hours of receiving the inflow, Zondacrypto’s hot wallet processed fewer than one thousand outgoing transactions. Approximately 67% of the value, around 772,000 USDC, was forwarded to the same Kraken deposit address we had identified earlier as the recipient of the $21M flow. The remaining 33% was distributed across smaller transfers, some to identified exchange deposits consistent with customer withdrawals, others to unidentified addresses.
In response to the first wave of media coverage, Zondacrypto began publishing daily totals of customer withdrawals processed in crypto. The exchange continued this practice for only three days before stopping. We treated those three days of self-reported figures as a verifiable test point and cross-checked them against the on-chain data. The numbers reconciled, but only when transfers to the Kraken deposit were excluded from the count. If those transfers had been customer withdrawals, the published totals would have been substantially higher. The fact that the exchange did not include them in its own totals suggested the Kraken deposit was operated by Zondacrypto itself, not by its users. The exchange was asked to confirm or deny ownership of that address. It did not respond.
A similar pattern was observed with Zondacrypto’s own ZND token, which moved repeatedly from the hot wallet to a KuCoin deposit address, with USDC, ETH, and other assets returning. Between April 5 and April 26, the ZND balance on the main hot wallet fell by 99.8%.
After the statement: the unraveling
On April 16, Zondacrypto’s CEO published an 18-minute video on X. He pointed to a wallet address holding roughly 4,500 BTC, said the company had no access to the private keys, and stated that the keys had been held by the former founder of Zonda (previously known as BitBay), Sylwester Suszek, who had been missing since March 2022, shortly after he sold the exchange. The address he displayed had been dormant since 2016 and had no visible on-chain connection to any known Zondacrypto or Suszek wallet.
The next day, the exchange’s own deadline to resume withdrawals expired with withdrawals still frozen. Four senior Polish ministers held a press conference at the Prime Minister’s Office. The Prosecutor’s Office opened a criminal investigation under Article 286 §1 (fraud) and Article 299 (money laundering), with an initial damage estimate of at least 350M PLN ($96.4M) and the case assigned to the Central Bureau for Combating Cybercrime. The originally assigned lead prosecutor recused himself within hours, citing prior cooperation with Zondacrypto. According to Onet, the CEO left Poland for Israel on the same day; the report has not been officially confirmed.
In the days that followed, the company’s Chief Compliance and AML Officer resigned, then the entire supervisory board of BB Trade Estonia OÜ, citing “material inconsistencies between public statements and operational reality.” On April 21, the CEO signed a farewell statement to staff. On April 23, Zondacrypto.com went offline; corporate email and the company’s Slack workspace were shut down. As of today, April 28, the Prosecutor’s Office spokesman has confirmed over 700 registered victims, with estimates reaching into the tens of thousands and damages “certainly larger than 350M PLN ($96.4M)”. According to the information published by the exchange, the victim was supposed to have around 1.3M customers (mostly from Poland).
What this case shows
Three things, in our view.
The first is that public-ledger transparency is not optional infrastructure for the tokenized economy. It is the basic primitive that makes self-correction possible. When an exchange will not publish wallet addresses or implement Proof of Reserves, the absence is itself a piece of evidence. In this case, the exchange held the tool to neutralize the speculation in minutes and chose not to use it. That choice is what made the on-chain data legible.
The second is that “the funds are there, trust us” is no longer adequate communication from a regulated exchange in a withdrawal crisis. Binance, Kraken, OKX, and others publish Proof of Reserves, audited by firms such as Hacken, without violating DORA or MiCA. The regulatory argument against disclosure does not survive comparison with the rest of the market.
The third is operational. The relevant reference point for crisis response in this category is now ByBit’s February 2025 response to a $1.5 billion cold-wallet hack: an official statement within hours, full withdrawal restoration in twelve, and reserves replenished within seventy-two. Zondacrypto, with reportedly far smaller exposure, processed under a thousand outgoing transactions in 48 hours after sustained withdrawal queues, citing “manual processing.” The gap between those two responses is the difference between an exchange that has prepared for a crisis and one that has not.
What forensic analysis can and cannot do
We do not investigate exchanges by default. The investigation began because public signals, internal tests, and the absence of corporate communication converged in a way that made the question worth asking. Once asked, blockchain analytics could provide most, though not all, of the answer.
The case demonstrates the floor of what public-ledger investigation can achieve in a regulated EU jurisdiction with an exchange that does not cooperate: hot-wallet balances and trends, systematic flows to peer venues, correlation patterns against off-chain events, real-time monitoring of post-disclosure responses. It does not demonstrate the ceiling. With cooperation from the exchange itself, or from its declared custody providers, the same questions could have been answered in hours rather than weeks, and with full numerical certainty rather than calibrated inference.
That is the gap that our institutional partnerships are designed to close: an operating standard for VASPs, banks, and law enforcement where incident response is structured, transparent, and fast enough to keep up with how the threat actually moves.
Key coverage:
What individual users affected by Zondacrypto can do
Two practical steps, on top of consultation with a lawyer:
File a formal written demand for the return of funds directly with the exchange’s operating entity, with proof of receipt. Then file a notification with law enforcement, with a copy directed to Kraken as the venue connected to the documented flows. Time matters. The earlier claims are documented, the better the position when recovery channels open.
For institutional partners, exchanges, and legal teams handling exposure to this case, immediate forensic intervention is the difference between traceable assets and assets that have already entered obfuscation services. Contact us if you’d like to discuss including our services in your offering.
