Summary
- Jonathan Spalletta was found guilty by a Manhattan jury of computer fraud and money laundering related to two hacks of Uranium Finance in 2021.
- He misappropriated over $50 million, funneled the stolen funds through Tornado Cash, and indulged in rare card purchases.
- Authorities confiscated cryptocurrency from the hacks valued at approximately $31 million during a seizure in February 2025.
A jury in Manhattan has convicted Jonathan Spalletta for committing computer fraud and money laundering linked to two hacks of the decentralized exchange Uranium Finance in 2021, as announced by federal prosecutors on Wednesday.
The 36-year-old from Rockville, Maryland, faced charges in March regarding these exploits. Following a six-day trial presided over by U.S. District Judge Jed S. Rakoff, he was found guilty on all counts. He could face up to 10 years in prison for the fraud charge and 20 years for money laundering.
Jonathan Spalletta has been convicted of defrauding a crypto exchange of over $50 million in hacks: "Our prosecutors and agency partners have done exceptional work to ensure that Spalletta’s virtual world criminal activities resulted in a real-world conviction," stated U.S. Attorney.
— US Attorney SDNY (@SDNYnews) October 7, 2026
In the first incident on April 8, 2021, Spalletta executed a series of transactions with Uranium's smart contract, extracting rewards far exceeding his entitlement, amounting to around $1.4 million. He subsequently coerced Uranium into allowing him to retain approximately $386,000, which prosecutors described as a bogus "bug bounty," in exchange for returning the remaining funds.
Just two weeks later, he boasted in a message to another individual: "I conducted a crypto heist of $1.5MM a couple of weeks ago... There was a bug in a smart contract, and I exploited it... Crypto is all fake internet money anyway."
On April 28, 2021, he exploited another flaw in the contract’s withdrawal calculations across various liquidity pools, stealing around $53.3 million and forcing Uranium to shut down due to insufficient funds.
U.S. Attorney Jamie McDonald remarked, "Spalletta's actions caused significant financial losses to real people—over $50 million—and led to the collapse of an entire crypto platform."
Collectibles and Laundered Funds
Spalletta laundered the stolen money through multiple transactions, including using the coin mixer Tornado Cash, and spent the proceeds on collectibles such as Magic: The Gathering and Pokémon cards.
Among his purchases were a Black Lotus card for around $500,000 and 18 sealed Alpha Booster packs costing about $1.5 million. For Pokémon, he acquired a complete first edition base set for approximately $750,000 and a sealed box of first edition booster packs for about $257,500.
Additionally, he purchased an Eid Mar denarius, a Roman coin commemorating Julius Caesar's assassination, for around $601,545, and a fabric piece from the Wright brothers' original airplane that Neil Armstrong took to the moon for about $137,500.
Law enforcement seized the Black Lotus, the fabric, and some coins from his residence under a search warrant. In February 2025, they also confiscated cryptocurrency valued at about $31 million from the Uranium hacks during a seizure.
Prosecutors are urging anyone who believes they were affected by the Uranium hacks to reach out to Homeland Security Investigations.