Key facts
- Jonathan Spalletta was convicted of computer fraud and money laundering for two hacks of Uranium Finance.
- The hacks in 2021 resulted in the theft of over $50 million.
- Spalletta laundered the stolen funds through Tornado Cash.
- He spent a significant portion of the stolen money on rare Magic: The Gathering and Pokémon cards.
- Authorities seized approximately $31 million in cryptocurrency related to the hacks in February 2025.
- Spalletta faces a maximum of 10 years for computer fraud and 20 years for money laundering.
A Manhattan jury has convicted Jonathan Spalletta of computer fraud and money laundering for orchestrating two hacks of the decentralized crypto exchange Uranium Finance in 2021, resulting in the theft of over $50 million. Spalletta, 36, of Rockville, Maryland, was found guilty on all counts after a six-day trial.
In the first hack on April 8, 2021, Spalletta exploited a bug in Uranium's smart contract to withdraw approximately $1.4 million in excess rewards. He reportedly pressured the exchange into giving him about $386,000 as a "bug bounty" for returning the remainder. Weeks later, he described the exploit to another individual as a "crypto heist."
On April 28, 2021, Spalletta executed a second, larger exploit by taking advantage of an error in the contract's withdrawal calculations across multiple liquidity pools, stealing about $53.3 million and leading to Uranium Finance's shutdown due to insufficient funds.
Following the theft, Spalletta laundered the funds through various transactions, including the use of the coin mixer Tornado Cash. He then spent a substantial portion on high-value collectibles, such as a Black Lotus card for $500,000, 18 sealed packs of Magic: The Gathering Alpha Booster cards for $1.5 million, a first edition complete base set of Pokémon cards for $750,000, and a sealed box of first edition booster packs for $257,500.
Authorities seized some of the purchased items, including the Black Lotus card, from Spalletta's home. In February 2025, law enforcement also seized cryptocurrency linked to the hacks, valued at approximately $31 million at the time of seizure. Spalletta faces a maximum of 10 years in prison for computer fraud and 20 years for money laundering.