A federal jury in New York (SDNY) has found Jonathan Spalletta guilty of computer fraud and money laundering charges. The 36-year-old Maryland resident was convicted as the perpetrator behind the $55 million exploit of the Uranium Finance protocol in mid-2021. Before Judge Jed Rakoff, prosecutors outlined Spalletta’s background - a cybersecurity consultant who exploited security vulnerabilities he was supposed to protect.
However, trial details highlighted something even more striking: where the tens of millions of dollars in crypto assets were spent by the consultant.
Two Attack Phases That Shut Down the Protocol
Spalletta carried out his scheme in two separate attacks. On April 8, 2021, he kicked off the exploit by draining $1.4 million from Uranium Finance’s reward smart contract. Following this initial strike, the perpetrator extorted $386,000 from the protocol’s developers under the guise of a fake bug bounty program as hush money to keep his actions from being reported to law enforcement.
The extortion was not the end of his attacks. On April 28, 2021, Spalletta re-entered the protocol’s systems and exploited a liquidity withdrawal flaw while Uranium Finance was migrating to version 2.1. His actions that day drained approximately $53.3 million in assets across 26 liquidity pools. The back-to-back losses forced Uranium Finance to shut down operations permanently.
From Crypto to Roman Coins and Collectible Cards
The stolen proceeds were promptly laundered through the Tornado Cash mixer. Once the on-chain trail was severed, Spalletta spent the funds in the physical world to amass millions of dollars in rare collectibles.
Prosecutors detailed the perpetrator’s shopping list, which included Pokémon cards and Magic: The Gathering playing cards totaling more than $3 million. Among the hoard was a legendary Black Lotus card, highly sought after by collectors. Spalletta also spent $601,545 to purchase an ancient Roman Eid Mar Denarius coin, and paid $137,500 for a fabric swatch from the Wright brothers’ aircraft that had been taken to the moon.
His spending spree came to an end when US federal law enforcement tracked down and raided his residence in February 2025. In the raid, agents seized approximately $31 million in remaining stolen crypto assets along with all the collectibles from his home.
Facing Decades in Prison
Spalletta is currently awaiting sentencing, scheduled by the judge for February 16. The money laundering charge carries a maximum sentence of 20 years in prison, while the computer fraud violation carries an additional potential sentence of up to 10 years.
For Uranium Finance, the guilty verdict comes years after their protocol was ruined - not by a random hacker, but by a security consultant. Reported by crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
