U.S. prosecutors have charged a Maryland resident in connection with the April 8, 2021 Uranium Finance exploit. Investigators allege that Spalletta targeted a weakness in the protocol’s reward system and moved roughly $1.4 million in digital assets to an account under his control. Authorities also claim that after the exploit, he tried to hide what happened by negotiating a fraudulent bug bounty arrangement, which allegedly allowed him to keep cryptocurrencies valued at $386,000.
Liquidity pools were drained and the protocol shut down
According to the case details, core liquidity pools holding assets such as BNB and BUSD were quickly emptied after the breach. The losses could not be recovered, and Uranium Finance ultimately closed permanently. The report adds that authorities seized about $31 million in crypto assets tied to the incident in February 2025, showing that recovery efforts continued long after the original attack.
The article describes this as the first prosecution launched since the original exploit in relation to a major DeFi hack. Uranium Finance has remained offline since the incident, while investigations and asset recovery efforts in the U.S. and other jurisdictions continued until the case reached its current stage.
Indictment says stolen funds were routed through Tornado Cash
The indictment says Spalletta laundered proceeds from the theft through complex transactions, including the use of crypto mixer Tornado Cash. Prosecutors say the funds were later converted into expensive collectibles. Those purchases allegedly included a Black Lotus Magic: The Gathering card estimated at $500,000, sealed Alpha booster packs worth about $1.5 million, first-edition Pokémon sets valued at more than $1 million in total, and the rare “Eid Mar” Roman coin linked to Julius Caesar’s assassination, believed to have cost around $601,500.
Prosecutors also disclosed a private message allegedly sent by Spalletta after the attack: “I pulled off a crypto heist… Crypto is just fake internet money anyway.” The complaint says he took multiple steps to hide the origin of the funds and directed the money into luxury collectible purchases. The report says Spalletta has surrendered to authorities and is expected to appear before a judge in Manhattan.
Case puts DeFi security and enforcement back in focus
The prosecution brings renewed attention to security gaps in DeFi protocols and to the methods used to move, mix, and spend stolen crypto. Industry observers cited in the report see the case as part of the broader regulatory and security pressure facing decentralized finance projects after years of rapid expansion. The article also notes that the outcome could shape how future DeFi-related prosecutions are handled.