Key Takeaways
- A Manhattan jury convicted Jonathan Spalletta of computer fraud and money laundering over two 2021 hacks of Uranium Finance.
- Spalletta took about $53.3 million in an April 28, 2021 attack, after a first hack that netted about $1.4 million.
- Prosecutors say Spalletta laundered the stolen crypto through Tornado Cash and spent part of it on rare Pokémon and Magic: The Gathering cards.
A Manhattan jury convicted Jonathan Spalletta on October 7, 2026, of computer fraud and money laundering over two 2021 hacks of the Uranium Finance crypto exchange, federal prosecutors said. Spalletta stole more than $50 million, causing Uranium to shut down for lack of funds.
How the Uranium Finance Hacks Unfolded in April 2021
The first attack came on April 8, 2021. Prosecutors said Spalletta repeated a series of transactions with Uranium's smart contract to withdraw far more rewards than he was entitled to, taking about $1.4 million. He then pressured the exchange into letting him keep about $386,000 as what prosecutors called a sham "bug bounty," in exchange for returning the remainder. Uranium operated as an automated market maker on Binance's BNB Chain, according to BleepingComputer.
On April 28, 2021, Spalletta exploited an error in how the contract calculated withdrawals across several liquidity pools. He took about $53.3 million, and Uranium shut down for lack of funds. Two weeks after the first hack, he wrote to another person that he had done a crypto heist, and that crypto is all fake internet money anyway, according to Decrypt.
Why the Second Drain Dwarfed the First
Put the two attacks side by side and the April 28 haul was about 38 times the April 8 haul. The $53.3 million taken in the second attack is roughly 38 times the $1.4 million from the first, based on the figures in Decrypt. The first attack ended in a negotiation over a bounty, while the second ended the exchange itself. That gap is the core of the case, because the verdict covers both thefts rather than only the larger one.
Where the Stolen Crypto Went and What Authorities Recovered
Prosecutors said Spalletta laundered the proceeds through Tornado Cash, a cryptocurrency mixer, and spent the money on rare Magic: The Gathering and Pokémon cards. Decrypt reported that he also bought a Roman coin marking Julius Caesar's assassination and moon-flown Wright brothers fabric. Authorities seized cryptocurrency linked to the hacks worth about $31 million at the time of seizure in February 2025.
Set against the $54.7 million taken across both attacks, that seizure equals about 57 percent of the gross haul. The figure uses the value at the time of seizure, so it is not a measure of what the seized assets are worth today.
What the Uranium Finance Verdict Means for Crypto Theft Cases
Federal prosecutors framed the verdict around the people who lost money rather than the technology used. "Spalletta's crimes cost real people to lose real money-over $50 million dollars-and caused an entire crypto platform to collapse." said U.S. Attorney Jamie McDonald, according to Decrypt.
Spalletta's own messages argued that crypto is not real money, and the conviction on computer fraud and money laundering treats the withdrawals as theft from people who lost real funds. For anyone tracking exploits on decentralized exchanges, the case shows that a smart contract flaw can still lead to a federal conviction years after the attack.
People Also Ask
Who is Jonathan Spalletta?
Jonathan Spalletta is a Maryland man who was convicted by a Manhattan jury on October 7, 2026, of computer fraud and money laundering. Prosecutors say he hacked the Uranium Finance exchange twice in April 2021, taking more than $50 million.
How much did the Uranium Finance hacker steal?
Prosecutors say Jonathan Spalletta took about $1.4 million in the first attack on April 8, 2021, and about $53.3 million in the second attack on April 28, 2021. Combined, the two attacks total roughly $54.7 million before any recovery.
Did authorities recover any of the money from the Uranium Finance hacks?
Yes. Authorities seized cryptocurrency linked to the hacks worth about $31 million at the time of seizure in February 2025. Prosecutors said Jonathan Spalletta also spent part of the proceeds on rare Magic: The Gathering and Pokémon cards.
Is there a sentencing date for Jonathan Spalletta?
The reports reviewed for this story do not state a sentencing date. Jonathan Spalletta was found guilty on both counts, computer fraud and money laundering, in the October 7, 2026 verdict.
Sources: Decrypt, BleepingComputer.