The 4,500 bitcoin no one can reach: custody risk inside Poland's biggest crypto collapse

Katowice prosecutors this week charged a fifth person in the collapse of Zondacrypto, once Poland's biggest crypto exchange. But the name that should matter to anyone holding crypto is not the new suspect — Rafał Zaorski, a prominent stock trader. It is a number attached to a wallet that no one has been able to open for months: roughly 4,500 bitcoin, worth about $350 million at current prices, whose private keys were reportedly never handed over when the exchange changed hands. The fifth suspect is a symptom. The unreachable wallet is the story, and the reason it stays unreachable is found in a legislative vote in Warsaw, not in Warsaw's courts.

The cold wallet that was never transferred

Zondacrypto began life in 2014 as BitBay, launched by a Polish founder named Sylwester Suszek. In early 2021, after the company was allegedly sold and rebranded as Zondacrypto with its headquarters moved to Estonia, a lawyer named Przemysław Kral took over management. Suszek, the original owner, has been missing since 2022.

That ownership change is where the central fact sits. Kral denies misappropriating funds; his account is that the wallet's private keys were intended to be transferred by Sylwester Suszek and never were. The wallet was, by the exchange's own disclosure in mid-April, inaccessible. In other words, roughly 4,500 bitcoin sat in a vault whose keys were held — or not held — by a man who had disappeared years earlier and a successor who was now saying he never received them. The bitcoin is reported still unreachable.

What followed is a series of receipts. Kral stopped responding in public after the April disclosure and was reportedly in Israel, where he holds citizenship and which does not extradite its own citizens. He has since been charged with participation in an alleged large-scale fraud and, per Polish media, is cooperating with prosecutors in exchange for seeking a reduced sentence — testimony that reportedly extends to how the exchange funded right-wing politicians and organizations. Suszek, for his part, is not cooperating at all. The Estonian operator, BB Trade Estonia, was declared bankrupt on August 27. Prosecutors put confirmed customer losses at no less than 350 million zloty ($95 million), with broader estimates running toward 2.4 billion zloty, or about 535 million euros, depending on what is counted.

The regulatory gap is the mechanism

Here is the letter that should be checked, because it is the part of this case a U.S. investor can generalize from. The European Union passed its Markets in Crypto-Assets Regulation (MiCA) in 2023, and every member state was supposed to have a working national framework by July 2026. MiCA is, in plain terms, a custody and disclosure rulebook: it requires exchanges to safeguard customer assets separately from their own, to be upfront about how assets are held, and to face a designated supervisor. Poland is now the only EU member state without a functioning national framework — because President Karol Nawrocki vetoed the implementing bill three times, most recently on June 11.

On September 5, the Sejm, Poland's lower house, tried to override the veto. It failed — 241 votes to override, 198 against, three abstentions, twenty-five short of the 266 needed. The Polish Financial Supervision Authority has acknowledged that the country still lacks an authority responsible for supervising the cryptoasset market. The government's own framing is that oversight could have prevented this: Prime Minister Donald Tusk's finance minister cited the Zondacrypto investigation, with its investor losses, as the case for stricter rules. President Nawrocki's office counters that the expanded powers would drive legitimate firms abroad.

Read the veto as an identity question and the collapse becomes legible. On a MiCA-compliant exchange, the customer's bitcoin is a segregated, supervised asset — a claim with a regulator behind it. In Poland's vacuum, the same customer's bitcoin is an unsecured claim against a company in bankruptcy court, competing with every other creditor. Same token, different legal identity, depending entirely on which set of rules applies to whoever is holding it.

The house token that paid for the exit

There is a second mechanism here, and it is the one that turns this from a Poland story into a general warning. Zondacrypto issued its own token, ZND, an ERC-20 token on Ethereum that cost a few dozen dollars' worth of network fees to create. Its white paper allocated 27% to public and private sales, leaving 73% in pools controlled by the issuer. The exchange steered customers toward being paid in ZND rather than in real assets: take half your rewards in the house token and receive a 10 percent bonus, take all of them and receive 20 percent. That is not a loyalty program; it is a way of paying customers with newly printed house credits instead of depleting the exchange's own bitcoin reserves.

The books tell the same story. ZND-linked revenue helped BB Trade Estonia's results; by December 31, 2024, the company reported 722.36 million euros in obligations to clients against only 9.73 million euros in cash. Blockchain tracing in the report shows 99 million ZND tokens were moved to addresses attributed to the external exchange KuCoin within eleven days while domestic customers were shown prices up to five times higher than external markets. This is the familiar FTX-and-Celsius reflexivity: a token's price looks high on a closed exchange, which draws fresh deposits, while the issuer quietly sells supply elsewhere for real assets. The parallel carries a break condition with it — the structure collapses the moment redemptions are demanded faster than the house can print or pay.

What that leaves a holder to check

Custody risk is asset-level risk, and it is the part of this case that generalizes to any exchange anywhere, including ones a U.S. investor might hold balances on. Before trusting a platform, the checks are concrete: Are customer assets segregated from the company's own balance sheet, and can you verify it? Is there a designated regulator that actually supervises custody and disclosure — and what does that regulator require in an insolvency? And if a platform pays you in its own token, understand that the token is a claim on the exchange's ability to keep printing, not a store of value — its price is only as good as the ledger behind it.

On the specific facts, the dossier is graded like this: the transfer history, the missing keys, the 722 million-euro-vs-cash line, and the ZND offer structure are documented. The fraud itself is alleged, not adjudicated; the fifth suspect is charged, not convicted. The break condition for the version of events laid out above would be a functioning Polish MiCA framework that forces segregation and disclosure — or a recovery from the 4,500 bitcoin that would show the custody story was wrong. Until one of those appears, the wallet stays the best exhibit: 4,500 bitcoin of customers' money, whose keys sit with a man who is not talking, under a rulebook the country has decided, three times, not to have.