A Manhattan jury has convicted Jonathan Spalletta of computer fraud and money laundering in connection with two 2021 hacks of decentralized crypto exchange Uranium Finance, federal prosecutors said Wednesday.
Spalletta, 36, of Rockville, Maryland, was charged in March. After a six-day trial before U.S. District Judge Jed S. Rakoff, he was found guilty on all counts. Prosecutors said he faces a maximum of 10 years in prison for computer fraud and 20 years for money laundering.
Two exploits in April 2021
According to prosecutors, the first hack took place on April 8, 2021. Spalletta repeatedly carried out a series of transactions involving Uranium’s smart contract and withdrew rewards far above what he was entitled to receive, taking about $1.4 million.
Prosecutors said he then pressured Uranium to let him keep about $386,000 as what they described as a sham bug bounty in exchange for returning the rest of the funds.
Two weeks after that first exploit, he wrote to another person: 「I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway.」
The second exploit came on April 28, 2021. Prosecutors said he took advantage of an error in how the contract calculated withdrawals across several liquidity pools, stealing about $53.3 million and causing Uranium to shut down because it no longer had enough funds.
U.S. Attorney Jamie McDonald said: 「Spalletta's crimes cost real people to lose real money—over $50 million dollars—and caused an entire crypto platform to collapse.」
Funds routed through transactions and spent on collectibles
Prosecutors said Spalletta laundered the proceeds through a series of transactions, including through coin mixer Tornado Cash, and then used the money to buy collectibles including Magic: The Gathering and Pokémon cards.
His Magic: The Gathering purchases included a Black Lotus card for about $500,000 and 18 sealed packs of Alpha Booster cards for about $1.5 million.
For Pokémon items, prosecutors said he paid about $750,000 for a first-edition complete base set and about $257,500 for a sealed box of first-edition booster packs.
He also bought an Eid Mar denarius, a Roman coin commemorating the assassination of Julius Caesar, for about $601,545. Another purchase was a piece of fabric from the Wright brothers' original airplane that Neil Armstrong carried to the moon, for about $137,500.
Seizures and victim outreach
Authorities seized the Black Lotus card, the fabric, and some of the coins from his home under a search warrant, prosecutors said.
In February 2025, authorities also seized cryptocurrency tied to the Uranium hacks that was worth about $31 million at the time.
Prosecutors asked anyone who believes they were a victim of the Uranium hacks to contact Homeland Security Investigations.
