The keys belonged to a man who disappeared. The exchange kept trading anyway.

Marek refreshed the page again.

The status bar on the withdrawal request had not moved in four days. He was sitting at the kitchen table in a flat in Katowice, the laptop open next to a mug of tea that had gone cold an hour ago, his daughter doing math homework in the next room. It was December 2025. He had been trying to pull out about a third of what he held on Zondacrypto. Nothing dramatic. He wanted to put a new water heater in the bathroom before winter got serious.

The withdrawal said pending. It had said pending on Monday. It said pending on Friday. The support ticket he had opened received an automated reply and then a real reply that said the matter was being reviewed. He was forty-seven years old. He dispatched trucks for a logistics company. He had moved his savings onto Zondacrypto in 2021 because it was the Polish one. His cousin used it. It had an office address you could drive past. The founder had been on television.

He kept refreshing. He did not know yet that the keys to the largest wallet the company had ever held were sitting wherever Sylwester Suszek was sitting, and that nobody had heard from Sylwester Suszek since March 2022.

I.

The room I want you to picture is a room with one door and one key. Inside the room sits 4,500 Bitcoin. That is what is called a cold wallet. A cold wallet is exactly what it sounds like. It is a place where crypto is kept offline, off the trading screens, off the internet, in storage. The key to the room is a string of letters and numbers called a private key. Whoever has the private key can open the door. Whoever does not, cannot.

There is only one key to this room. The man who had it, the founder of the exchange, Sylwester Suszek, disappeared in March 2022. He had sold the company in 2021. He walked away. The key walked away with him.

For the next four years, the exchange continued to operate. It accepted deposits. It displayed balances. It ran ads. It rebranded. The lobby of the building stayed open and the receptionist kept handing out tickets to a room that nobody could enter.

That is the machine. That is the entire architecture of what Polish prosecutors are now calling a fraud investigation. One locked room. One missing keyholder. And a business that kept selling tickets.

II.

Zondacrypto was founded in 2014 as BitBay. By the late 2010s it was one of the largest crypto exchanges in Poland. In 2018 the Polish Financial Supervision Authority, the KNF, placed it on a public warning list for suspected unauthorized payment services. The warning sat there. The company kept operating. Customers like Marek kept signing up because the warning was buried in a regulator's database and the marketing was on television.

Suszek sold the company in 2021. He disappeared in March 2022. The current CEO is Przemysław Kral. For years Kral told customers and reporters that the exchange was financially stable. He denied allegations. He attributed any difficulties to the previous founder's departure.

Then the on-chain analysts arrived.

On April 6, 2026, a public analysis showed that Zondacrypto's hot wallet, the part of the exchange that handles day-to-day customer activity, had lost 99.7 percent of its Bitcoin reserves between August 2024 and March 2026. Read that slowly. Ninety-nine point seven percent. The exchange had been bleeding out for nineteen months in public, on a blockchain anyone could read, while the website kept showing customers a balance.

On April 17, 2026, the Katowice regional prosecutor's office opened a formal fraud investigation. According to prosecutors, losses are at least 350 million zloty (about $96M USD), and they expect that number to grow. Up to 30,000 users may be affected. On April 23 the entire oversight board resigned. Kral confirmed in writing that nobody at the exchange had access to the 4,500 BTC cold wallet.

At today's prices, 4,500 BTC is worth more than $330M USD. It is in a room. The room has one door. The door has one key. The key is with a man nobody can find.

III.

Kral is reportedly in Israel. He holds Israeli citizenship. Israel does not generally extradite its own citizens. The Polish deputy interior minister has acknowledged this complication on the record.

Picture the geometry of what that means. The founder with the keys is missing. The CEO who ran the exchange while the hot wallet drained is in a country that will not send him back. The investigators are in Katowice with a list of 30,000 names and a wallet they cannot open.

Prime Minister Donald Tusk has gone further. He has publicly suggested possible links to Russian funds and foreign political influence, comparing the case to past Polish financial scandals. Those are allegations. They are being investigated. Allegation is not adjudication. But the political weight has now moved.

On May 11, Tusk announced a draft bill with harsher penalties for financial crimes tied to digital asset platforms. On May 13, the Sejm accepted the MiCA implementation bill for consideration. On Friday, May 15, 2026, the same week the prosecutors confirmed the scale of the losses, Polish lawmakers passed the bill that brings Poland into compliance with the European Union's Markets in Crypto-Assets Regulation, known as MiCA. MiCA is the EU's attempt to put a single set of rules around crypto exchanges, custody, and token issuance across all member states. Poland had a July deadline. President Karol Nawrocki had vetoed two earlier versions. The third one passed.

The press release on Friday was about regulatory harmonization. The story underneath it was about a locked room.

IV.

Marek does not know yet whether he will see his money. Nobody in his position does. The investigation is open. The cold wallet is closed. The hot wallet is empty. The CEO is abroad. The founder is gone.

What he does know is that the withdrawal screen in December was not a glitch. It was the building telling him, through the only language it had, that the room at the back was already locked.

This is the part worth sitting with. Marek did not do anything stupid. He used the largest Polish exchange. He used the one with the office and the television ads and the cousin's recommendation. The KNF warning from 2018 was technically public. So is a phone book. The machine was designed so that the surface looked like a bank and the architecture looked like a vault and the keyholder was a man who had been gone for four years.

The polite name for what happened here is "operational failure." The renamed version is simpler. An exchange continued to take customer money for forty-five months after losing the ability to honor its largest custodial obligation. Whether that was fraud or negligence is what the Katowice prosecutors will decide. The mechanism is the same either way.

V.

There is a thing the crypto industry has been telling itself for a decade. Not your keys, not your coins. It is meant as a warning to people who leave their money on exchanges. It is true. It is also incomplete.

The full version is this. Somebody's keys, somebody's coins. The question every customer of every exchange should be asking, and almost nobody does, is whose keys, and where are they, and what happens if that person stops answering the phone.

In Katowice, a dispatcher refreshes a withdrawal screen.

In a room nobody can open, 4,500 Bitcoin sits exactly where it sat in March 2022.

The keys belong to a man who is not coming back.