Uranium Crypto Exchange Hacker Convicted for Stealing $53 Million

Uranium Finance Hacker Found Guilty on Every Count

A federal jury in Manhattan has convicted Jonathan Spalletta, a 36-year-old cybersecurity consultant from Rockville, Maryland, of computer fraud and money laundering for hacking the decentralized exchange Uranium Finance twice in April 2021 and stealing more than $53.3 million in cryptocurrency. CosmicBytez Labs first reported the charges against Spalletta — who also went by the online aliases "Jspalletta" and "Cthulhon" — after he surrendered to law enforcement on March 30, 2026. The six-day trial, held before U.S. District Judge Jed S. Rakoff in the Southern District of New York, opened on September 28, 2026, and ended on October 7, 2026, when jurors returned a guilty verdict on every count in the indictment after roughly two hours of deliberation.

Case Details

From Charges to Conviction: What's New

Recap — The Original Hack

As detailed in our March coverage, Spalletta exploited two separate smart contract flaws in Uranium Finance, a Uniswap v2 fork running as an automated market maker on the BNB Chain. In the first breach on April 8, 2021, he issued zero-token withdrawal commands that tricked the protocol into paying out roughly $1.4 million in rewards he was not entitled to. According to trial evidence, he then pressured Uranium into granting him a sham "bug bounty" of nearly $386,000 from the stolen funds in exchange for returning the rest — an arrangement prosecutors argued at trial was extortion, not a legitimate disclosure process. Three weeks later, he returned to exploit a second coding error — a transaction-verification bug that used 1,000 instead of 10,000 as a scaling factor — allowing him to withdraw nearly 90% of the assets locked in Uranium's liquidity pools while depositing effectively zero tokens in return. The combined theft forced Uranium Finance to shut down.

The Trial

What the March article could not report is how the case played out in court. Prosecutors built their case around blockchain forensics, tracing roughly $26 million in stolen funds that Spalletta allegedly routed through the Tornado Cash mixer between 2021 and 2023, along with transfers through decentralized exchanges designed to break the on-chain trail. A crypto-tracing investigator's work in December 2023, linking approximately 11,200 ETH moved out of Tornado Cash back to wallets under Spalletta's control, became a pivotal piece of evidence connecting the mixed funds to his real-world identity.

Defense attorneys argued that Spalletta had not "hacked" anything in the traditional sense — he used publicly accessible functions within Uranium Finance's own smart contracts, they said, and never deployed spoofed credentials, stolen keys, or malicious code. The jury rejected that framing, convicting Spalletta on every count after a six-day trial and a swift, roughly two-hour deliberation.

How the Money Was Spent

Perhaps the most striking new detail to emerge at trial was what Spalletta did with the stolen funds. Rather than cashing out through conventional means, investigators say he funneled a significant portion of the laundered proceeds into high-value collectibles, including:

• 18 booster packs from Magic: The Gathering's Alpha set, valued at roughly $1.5 million
• A complete first-edition Pokémon base set, valued at approximately $750,000
• A Black Lotus Magic: The Gathering card, valued at around $500,000
• An ancient Roman coin depicting Julius Caesar, valued at approximately $601,000

Federal agents seized the collectibles from Spalletta's Maryland residence in February 2025, along with roughly $31 million in cryptocurrency, as part of the broader asset-recovery effort tied to the case.

Statutory Exposure and Sentencing

Spalletta now faces a maximum of 10 years in prison on the computer fraud count and up to 20 years on the money laundering count — statutory ceilings that Judge Rakoff will weigh against federal sentencing guidelines when he hands down a sentence. Sentencing is scheduled for February 16, 2027. U.S. Attorney Jamie McDonald said in a statement following the verdict: "Spalletta's crimes cost real people to lose real money — over $50 million dollars — and caused an entire crypto platform to collapse."

Impact Assessment

Recommendations

For DeFi Protocol Developers

• Commission independent smart contract audits before launch. Both exploited flaws in Uranium Finance — the zero-token withdrawal bug and the 1,000-vs-10,000 scaling error — were preventable with rigorous audit coverage and fuzz testing of edge-case inputs.
• Build emergency pause mechanisms into every contract. A circuit breaker triggered on anomalous withdrawal volume could have limited the damage from the second, larger exploit.
• Treat "bug bounty" negotiations under duress as incidents, not settlements. Document and report any payout made to an attacker who has already drained funds; it may constitute extortion and should be disclosed to law enforcement, not quietly absorbed as a disclosure cost.

For Security Teams and Incident Responders

• Preserve on-chain evidence immediately. The prosecution's case relied heavily on reconstructing transaction flows years after the fact — early, thorough documentation of exploit transactions strengthens any future investigation or civil recovery action.
• Engage blockchain forensics specialists early. Firms specializing in mixer de-anonymization and wallet clustering can identify attacker infrastructure long before funds are cashed out.

For Users and Investors

• Understand that DeFi deposits carry smart contract risk with no insurance backstop. Uranium Finance users lost their deposits permanently when the protocol collapsed; review audit history before supplying liquidity to any AMM.
• Recognize that crypto theft is not a dead end for law enforcement. The multi-year gap between the 2021 hacks and the 2026 conviction shows that statutes of limitations and mixer obfuscation are not guaranteed protection for stolen funds or the people who stole them.

Key Takeaways

1. Jonathan Spalletta was convicted on all counts — computer fraud and money laundering — by a Manhattan federal jury after a six-day trial and roughly two hours of deliberation.
2. The theft totaled $53.3 million, executed through two separate smart contract exploits against Uranium Finance in April 2021, forcing the protocol to shut down.
3. Blockchain forensics, not a confession, cracked the case — investigators traced roughly $26 million laundered through Tornado Cash back to Spalletta years after the initial theft.
4. Stolen crypto was converted into physical collectibles — including a $500,000 Black Lotus Magic: The Gathering card and a $750,000 first-edition Pokémon set — making seizure of non-crypto assets part of the recovery effort.
5. Spalletta faces up to 30 years combined statutory maximum (10 years computer fraud + 20 years money laundering), with sentencing set for February 16, 2027.
6. The "I only used public functions" defense failed — the verdict reinforces that exploiting legitimate smart contract calls in unintended ways is still criminal computer fraud under U.S. law.

Sources

• BleepingComputer — Uranium Crypto Exchange Hacker Convicted for Stealing $53 Million
• U.S. Attorney's Office, Southern District of New York
• Law360 — Cyber Consultant Convicted Of $53M Uranium Finance Heist

Related Reading

• Hacker Charged with Stealing $53 Million from Uranium