Three days before the founder of Poland’s largest crypto exchange was last seen, a wallet fed by the exchange’s reserves began to empty. The public ledger shows where 8,216 bitcoins went next.

On Thursday, 10 March 2022, Sylwester Suszek was seen for the last time, at a filling station in Czeladź, a town in the Silesian coal belt. He had founded BitBay, the exchange on which a generation of Poles bought their first bitcoin, and which had by then been renamed Zonda. He has not been seen since. For four years the story of what vanished with him was told by other people, and its most consequential version came in April 2026, when Zonda stopped paying its customers. The chief executive, Przemysław Kral, showed a single Bitcoin address beginning 16aEn4p6, holding some 4,500 coins, and explained that this was the exchange’s cold wallet and that the keys had been with Suszek. By August the operator, an Estonian company, was bankrupt.

This article is about what Bitcoin’s public ledger shows for that week. On 7 March 2022, three days before Suszek was last seen, a wallet fed by the exchange’s reserves held 8,216 bitcoins, then worth more than 300 million dollars. By 12 March it had been emptied. In the spring, 5,750 of those bitcoins moved on to deposit addresses of BitMEX, a derivatives exchange, and in December one of the last portions went into a mixing transaction, which blurs the trail. The coincidence of those transfers with the founder’s disappearance is extraordinary, and until this article no one had pointed it out in public.

 

What had been established

An exchange does not keep all its customers’ bitcoin within reach. A small part sits in a working wallet, from which daily withdrawals are paid. The rest is supposed to be held in a reserve cut off from the network, known as a cold wallet. The address that the chief executive showed in April 2026 was presented as exactly that.

That address has one remarkable property: nothing has ever left it. I have written about it three times. In April I showed that it does not behave like a cold wallet: an exchange’s reserve works, taking in the surplus in good times and giving it back in bad, whereas nothing has left this address since 2016. I then described its ten years of silence. In September I described a declaration of June 2025 in which the chief executive had affirmed before a notary that he had access to it, which is hard to reconcile with the story of keys that vanished with the founder.

In that last piece I left two possibilities open. In the first, BitBay had had no real reserve since 2016. In the second, a reserve existed and disappeared in 2022, in which case more than a billion zlotys of customers’ money was waiting to be found on the blockchain. This article follows the second trail. The question is simple: if the address the chief executive showed was not a working reserve, where was the reserve, and what became of it?

The answer matters in practice. According to the company’s own spreadsheets, customers were owed 2,887 bitcoins at the end of 2024, and the bankruptcy estate holds next to nothing. If a reserve existed and someone moved it, there is someone to ask and something to look for.

 

How to read the ledger, and what it does not show

Bitcoin has no bank keeping accounts. It has a single public ledger, the blockchain, in which every transfer since 2009 is recorded: from where, to where, how much and when. The ledger cannot be rewritten after the fact, and anyone can read it, years later as on the day. Amounts are counted in bitcoins (BTC), and the smallest unit, a hundred-millionth of a bitcoin, is called a satoshi.

The ledger knows no names. It knows addresses, strings of characters that work like account numbers. One person or company usually uses many of them. Databases such as WalletExplorer group addresses into wallets, or clusters, by a simple rule: if two addresses jointly funded one transfer, the same hand most probably controls both. That is strong circumstantial evidence, not proof. When I write of a wallet, I mean such a group of addresses.

Three things make the rest easier to follow. First, a Bitcoin transfer works like paying with a banknote: the whole coin is spent, and the unspent part comes back to the sender as change, usually to a new address. Second, coins split and merge on their way, so a trail branches, and I call the place where most of them come together a node. Third, some addresses need several keys at once to make a transfer, and some need one. The former are called multi-signature.

The trail starts from the opposite end to the chief executive’s address. In September I began with the wallet from which the exchange paid bitcoin out to its customers and went upstream, to the wallets that fed it. In December 2017 the main one of them also fed the wallet described here. From there I go downstream: I look at where this wallet sent its coins, and where they went next.

Everything below can be checked by anyone. The links lead to WalletExplorer, a public database that groups Bitcoin addresses into wallets, and all times are UTC. The ledger shows wallets, not people. I do not know who held the key.

 

A wallet born on the day of the peak

The first transaction of the wallet is a single bitcoin, on 17 December 2017, the day the price set its record for that cycle. It looks like a test: the same day one more bitcoin came in and one went out. Between 18 and 21 December came 1, 100, 400 and 500 BTC from a cluster that I described in September as the main feeder of BitBay’s withdrawal wallet. Then came batches of 400 and 500 BTC from multi-signature addresses, among them a cluster familiar from that earlier piece. One such transaction, on 27 December, left the sender a little under 50 BTC in change.

By 23 March 2018 the wallet held 13,579 BTC, and the last five batches had been 501, 502, 503, 504 and 505 coins, as if someone were numbering them. On 16 July 2018 the balance reached 18,691 BTC.

This looks like an exchange moving its reserves. In the example I checked, 500 BTC passed from outputs that required two of three signatures to an output later spent with one. A reserve guarded by several keys was moved to a place where one was enough. No doubt for convenience.

 

The certificate said 4,513.93 BTC. The wallet held 11,331

In 2021 Suszek signed a reserve certificate, an exchange’s statement of how much cryptocurrency it holds. According to it, at the end of 2020 the exchange held 4,513.93 BTC in cold wallets. The second part of the wallet I am describing held 11,331 BTC on the same day, two and a half times as much. The certified figure is, on the other hand, close to the balance of the silent address: it differs from it by under eleven bitcoins. If the certificate was describing that address, the wallet with 11,331 BTC is not in it. For a document with the word certificate in its name, that would be a good deal to leave out. Which figure described the customers’ reserve, the ledger cannot say.

It says something else. From at least the autumn of 2020 the wallet sent 20 to 200 BTC every few days or weeks to a single intermediate wallet. From there the coins moved on, partly through another pass-through wallet, to addresses the database labels as the exchanges Huobi and Kraken, and to a large unnamed cluster. By my count, more than 2,000 BTC left this way between October 2020 and March 2022. The exchange’s own withdrawal wallet, as I showed in September, was being fed in 2020 from elsewhere.

 

Three days before: twenty-two transfers

On the morning of 6 March 2022 the wallet sent its routine 50 BTC and, two hours later, 765 BTC, which came back the next day with more. On the evening of 7 March it held 8,216 BTC and began to empty. Twenty transfers went out by 9 March, and the last two on 12 March at 6:16. Another 322 BTC arrived along the way and left as well. What remained in the wallet was 4,914 satoshis, worth about two dollars at the time. The amounts were no longer round: 787, 376, 456, 476, 765, 345, 543. Nearly all the coins went to new wallets with addresses of a newer type. The largest of them collected 4,830 BTC.

Suszek was last seen on the 10th, a Thursday. The wallet got out ahead of him, and its last two transfers were recorded on the Saturday.

A wallet that had existed for more than four years gave up everything it held in five days, and did so in the week in which the exchange’s founder vanished. For four years this lay in the public ledger, visible to anyone who knew which wallet to look at.

In April I showed, from the commercial registers of four countries, that by the time he disappeared Suszek no longer held any office in the companies running the exchange. I wrote then that if this was a disappearance, it had been prepared with unusual professionalism. The Bitcoin ledger adds one more item to the preparations: the wallet was put in order three days before. Who did the ordering, the ledger does not say.

 

In the spring, 5,750 BTC went to BitMEX

BitMEX ran a derivatives exchange in 2022, a place for betting on the price to rise or fall, usually with borrowed money. Its deposit addresses began with the characters 3BMEX. On 19 March 2022, 500 BTC arrived at such an address, and on 15 June, 1,000 BTC. There were ten such transfers between 18 March and 15 June, to three addresses, 5,750 BTC in all, of which 3,300 came between 13 and 15 June, as the market was collapsing. That is the gross sum of deposits, not a loss. On 20 June, 500 BTC came back. What happened on the account, the ledger does not show: collateral for a position, a sale and a loss all look the same from outside.

The first deposit of 2022 to one of those addresses did not, however, come from the new wallets. On 6 March 2022, a day before the emptying began and four days before the disappearance, 100 BTC went there from the old wallet itself, out of the change of one of its earlier transactions. The remaining 241 BTC of that change returned to the wallet. The same address later took in 400, 400 and 1,000 BTC.

At least another 1,474 BTC went, between 9 March and 8 May, to a large unlabelled cluster that behaves like an exchange. On 13 August 2022 the largest node I found held 1,737 BTC.

The new wallet kept the old habits. On 25 April and 6 June it sent 50 BTC to the same intermediate wallet that the old one had been feeding since 2020, and on 28 March and 10 May smaller sums to the pass-through wallet already familiar. The addresses had changed, and the rhythm had not. On 11 April 6.76 BTC, and on 4 May 43.3137 BTC, went to a single address that the database assigns to a cluster it calls CoinJoinMess. That is the database’s label, not proof of mixing.

An exchange’s reserve sitting on another exchange’s account: Zonda’s customers know the feeling.

 

December 2022: fifty at a time, and a mixer

In the autumn the balance fell slowly, 20 to 40 BTC at a time. On 7 December 915.5 BTC remained, and the rhythm changed. Portions of a few dozen bitcoins began leaving several times a day, each to a fresh address: four on 9 December, of 50, 48.5, 42.99 and 52.25 BTC. On 12 December at 17:01, 504 BTC were left, and the next day another portion went out, 48.865 BTC.

I followed the last of the portions of 9 December. Forty minutes later it entered a transaction with more than two hundred outputs, eleven of them of exactly 11.62261467 BTC. That is three to the nineteenth power, counted in satoshis. Denominations of that kind are used by CoinJoin in the Wasabi 2.0 wallet: many participants put coins into one transaction and take them out in identical portions, which makes it hard to say which is whose. I checked one portion. For the others I am inferring from the pattern.

On 15 December the old intermediate wallet was emptied, and on 23 December the last 94.8 BTC left the node. Later transactions are public, but after the branching and the mixing, amounts can no longer be honestly attributed to this pool.

The interim trustee, appointed by the Estonian court before the bankruptcy was declared, dates the company’s possible lasting insolvency to the end of 2022, from the loss of access to the cold wallet, as I noted when writing about Kral’s reply to the trustee. The coincidence of dates proves no connection: the company is speaking of the address 16aEn4p6, and I of a different wallet. But the ledger shows that in the month to which the loss of access is dated, someone was spending a few dozen bitcoins a day from a wallet fed by the exchange’s reserves.

 

What follows

There are two main readings, and neither is comfortable.

In the first, this was the exchange’s cold wallet, only under a single key. Then the customers’ reserve existed until March 2022, and in nine months it was scattered across exchanges and a mixer.

In the second, BitBay’s reserves left the exchange in the winter of 2017 and from then on were someone’s private fortune. Then the question is on what basis.

I do not rule out a third: the wallet of another entity that settled accounts with the exchange. Against it stands the place the first money came from.

There is also the simplest explanation of all: the exchange was moving its reserve into professional safekeeping. I checked it as far as the available data allow. Since the spring of 2021 Zonda had used Fireblocks, software for keeping cryptocurrency behind several layers of approval, and BitGo, a custodian that holds it on a client’s behalf. According to Fireblocks exports that are among the documents of the bankruptcy proceedings, two of the exchange’s own vaults, as separate wallets are called there, had Bitcoin addresses at the time. The two addresses of the new wallets that I compared with them belong to neither. That is a partial test. BitGo then kept bitcoin in multi-signature wallets, and the new wallets are single-signature addresses. Nor did the coins rest where they landed: within a week they were flowing to BitMEX, and one of the December portions entered a mixing transaction, of the kind one joins from a wallet of one’s own. Professional safekeeping does not look like that.

Two documents from the same proceedings bear on these readings. Loan agreements show that in 2020 the exchange lent Suszek and his company in the Emirates at least 500,000 euros and more than three million zlotys, at interest. The second reading has to explain why the owner of eleven thousand bitcoins was borrowing from his own exchange. And bank statements show that in June 2023, fifteen months after he vanished, 1.04 million euros and 1.32 million zlotys arrived in the exchange’s account at a Swiss bank from an account held in Suszek’s name. The keys to the wallet, then, were not the only thing someone went on using after 10 March 2022.

In every one of these readings, someone had the keys after 10 March 2022 and used them for nine months. The story of a key that vanished with the founder does not describe this wallet. It describes the address 16aEn4p6, from which nothing has ever moved.

In April I explained how to recognise an exchange’s cold wallet: in a bull market it takes in the surplus, and in a bear market it gives it back. The address in the video did neither, hence the ten years of silence. This wallet did both, until it had given back everything. The second hypothesis of that inquiry was that Zonda never had the keys to the address 16aEn4p6. Now at least it is known to which wallet someone did have keys.

For scale: according to the company’s own spreadsheets, customers were owed 2,887 BTC at the end of 2024, and 60 lay with the custodian. Nearly all the rest of the declared cover was the address 16aEn4p6. The wallet I am describing held, in March 2022, almost three times that debt. By August the largest node I found held less.

 

What I do not know

  1. Who held the key, and who made the transfers of March and December 2022.
  2. Whose the BitMEX accounts are, and how many coins came back from them.
  3. What stands behind the large unlabelled cluster.
  4. How the reserve shrank from 18,691 BTC in 2018 to 11,331 BTC in 2020: through customers’ withdrawals or otherwise.
  5. Whether I have followed every branch. The figures for August and December concern the main node.
  6. Who controlled the further outputs of the 504 BTC branch.
  7. Whether none of the addresses in the new wallets belongs to the exchange’s vaults in Fireblocks. I checked two.
  8. Where the deposits came from that the same BitMEX addresses were receiving in the spring of 2020.

Grouping addresses into wallets is a rule adopted by the database: strong circumstantial evidence, not proof of ownership.

 

Who could close this in weeks

BitMEX identifies its customers as a bank does: it requires an identity document. It knows who holds the accounts with the addresses 3BMEX5L5ug17eBFD3iXtYjQQ8TS1CpxMFR, 3BMEX6HKjHSyp4mTuGVWBsuJg3oQTjGePt and 3BMEXniirhvGm3rfmZo49J1duij8rg3rmJ, who logged in to them in the spring of 2022, and where the funds were withdrawn. The accounts were not opened after the disappearance: the same addresses were already receiving deposits in the spring of 2020, when close to 1,300 BTC arrived at two of them. The trustee and the prosecutors have the power to ask. The trustee can also export the transaction history of March 2022 from Fireblocks and BitGo: if the reserve went there, it will show. Both routes are shorter than searching for the key to an address that has been silent for ten years.

In September I wrote that no one was looking for the real cold wallet, because everyone was looking at the wrong address. Now it is at least clear where to look, and from what date.

The firm’s other texts on this case are collected on the page Zonda (Zondacrypto): the affair, the bankruptcy and legal assistance.

 

Appendix: material for independent verification

  1. The reserve wallet, part one (17 December 2017 to 11 May 2020): 031df371ef7abacf.
  2. The reserve wallet, part two (to 12 March 2022): 007e1caaf24bbe2a.
  3. The intermediate wallet (to 15 December 2022): c025431df50f71cc.
  4. The new wallets of March 2022: 2b9e66e02169aa79, 3f5821dc616edde8.
  5. The cluster with the address 3BMEX5L5…: 0b4018c6bd68b59b.
  6. The nodes of June and August 2022: 189e68d9092c3b6d, 4727901dd572a90e.
  7. December 2022, successive links: 2218e78c0142ed37, ec8338a59838e415, fbe27f47f9a20dd6.
  8. Two transactions with an output to the address that the database assigns to the CoinJoinMess cluster: 11 April 2022, 4 May 2022.
  9. Bitcoin addresses of the two company vaults of the exchange in Fireblocks that existed in March 2022: 19FjLStz9V2j1uzcWfuqu6FXwcnHxMaUJN and bc1qt29zkcfzyfhgpu8vjqeeuglxx32k5hg578acgn, and 165cHABRGQ2LbxXw2FLGMfebW2LGCRFKLS and bc1qx7mmm60v0t3gsz2np3qfunje9xu5jnt39wc55q. I compared two addresses of the new wallets with them: bc1qh368avg9wjrmun9p7sr53wtwlmyveda6axfczv and bc1q7nfytvt2hltuj9h54l3qsujswj5g6f9w7v9tzr.
  10. Deposits to the BitMEX addresses in 2022: 6 March 100 BTC, 18 March 500, 19 March 500, 12 April 500, 8 May 400 and 150, 16 May 400, 13 June 1,000, 15 June 1,000, 800 and 500.

The Zondacrypto Case

The Zondacrypto case is being examined by authorities in several countries, and no one today can predict the fate of the entrusted funds. We represent the victims and protect their position in the ongoing proceedings.

See how we can help

Robert Nogacki is a Polish attorney at law (radca prawny), the founder and managing partner of Kancelaria Prawna Skarbiec (Skarbiec Law Firm), which has operated continuously since 2006.

The law is equal for everyone, but the parties rarely are: on one side stands an organization with time, money, and lawyers, on the other a person with one business, one nest egg, and one life.

Clients rarely come to him with a legal problem. They come with a problem that also has a legal side: an audit that began with a single invoice, money entrusted to someone who has disappeared, a company that has to be passed on before it is too late. Most such matters are decided long before the first letter is written, in decisions made without asking and in deadlines nobody remembered. So he begins by asking how the client got here, not what the client should have done.

He advises entrepreneurs and families from more than a dozen countries, including those whose accounts the tax office has just seized and who do not know what to do tomorrow morning. He defends them in tax audits, customs and fiscal inspections, disputes with the tax authorities, and criminal tax proceedings. He represents victims of investment fraud and Ponzi schemes. He helps families set up family foundations and plan succession, so that a life’s work outlasts a single generation.

Not every case can be won. Every case can be run so that the client knows where they stand. Since 2006 he has represented the victims in the WGI case (Warszawska Grupa Inwestycyjna, the Warsaw Investment Group), one of the longest criminal cases in the history of the Polish financial market, because some things must not be left half finished, even when they take two decades. In the case of the collapsed cryptocurrency exchange Zonda (Zondacrypto, operated by BB Trade Estonia OÜ), he represents several hundred victims in the criminal investigation conducted by Poland’s National Prosecutor’s Office and in the Estonian bankruptcy proceedings.

Kancelaria Prawna Skarbiec is listed in the rankings of Poland’s largest tax advisory firms published by Dziennik Gazeta Prawna and Rzeczpospolita, and it is a four-time recipient (2015 to 2018) of the European Medal awarded by the Business Centre Club and the European Economic and Social Committee. Robert Nogacki publishes regularly, in the press and on the firm’s website, for people who have a problem rather than a law degree, because a legal opinion the client cannot understand protects only the lawyer.

He believes that the best legal advice is the kind that means the client never has to appear in court.

Topical publications

On or about October 8, 2024, an employee of a large investment bank in New York,…

An idea keeps circulating around the bankruptcy of the Zonda exchange, and it sounds like a…

Until Tuesday, 27 October, customers of the collapsed Zonda exchange are filing their claims with the…

On 15 October 2026 the Court of Justice of the European Union ruled that a bank…

The Juventus and Raków contracts in detail: the clauses that protected the clubs, and the ones…

Kancelaria Prawna Skarbiec · Robert Nogacki, attorney-at-law · October 17, 2026 Poland’s Ministry of Finance answered…