Jury Convicts Jonathan Spalletta, Uranium Finance Hacker Behind 812 ETH Laundering Trail

Manhattan Jury Convicts Uranium Finance Hacker

A federal jury in Manhattan on Wednesday convicted cybersecurity consultant Jonathan Spalletta on every count of an indictment charging computer fraud and money laundering over two 2021 attacks that drained nearly $55 million from the decentralized exchange Uranium Finance. The U.S. Attorney's Office for the Southern District of New York disclosed the verdict in its conviction announcement, which followed a six-day trial before U.S. District Judge Jed Rakoff. Jurors deliberated for roughly two hours before returning the unanimous decision. Spalletta, 36, of Rockville, Maryland, had surrendered in the case on March 30 and was identified in charging papers by the online aliases “Cthulhon” and “Jspalletta,” with the matter assigned to the office's Complex Frauds and Cybercrime Unit. The statutory maximums differ sharply: 10 years on the computer fraud count and 20 on the money laundering count, with the office noting that Congress sets those caps and that a judge will determine the actual sentence. The trial turned on transaction records, not on the Ethereum (ETH) price; what convicted Spalletta was the on-chain trail the government tied to the stolen funds.

Two April 2021 Attacks

Prosecutors laid out two attacks at trial. Uranium Finance let users deposit and swap cryptocurrencies through liquidity pools, with software known as a smart contract holding the coins and paying out under fixed rules, an exchange that operated with no company in charge. On April 8, 2021, Spalletta targeted a reward contract that, much like a Crypto Faucet, dispensed tokens to claimants: by repeating a series of transactions he withdrew far more rewards than he was owed and drained nearly the entire pool, taking about $1.4 million. About two weeks later he described the scheme in a message to another person: “I did a crypto heist of $1.5MM a couple of weeks ago ... There was a bug in a smart contract, and I exploited it ... Crypto is all fake internet money anyway.” That dismissal reads today as textbook FUD in Crypto, and the jury effectively agreed it described theft. Prosecutors said he then pressured Uranium into letting him keep about $386,000 as a “bug bounty,” a payment the government called a sham. On April 28, 2021, he exploited a second flaw in the contract governing withdrawals, drained roughly $53.3 million from 26 pools, and the exchange shut down. His defense argued he had only used functions the platform left publicly available, rather than forged credentials or malicious code; the exploit turned on payout logic in the code, not on anything a trader could control through Order Types in Crypto Trading.

Pokémon Cards, Tornado Cash and Seizures

The laundering route ran through Tornado Cash, a mixing service that obscures where coins came from, before the proceeds turned into collectibles. Prosecutors listed a Black Lotus Magic: The Gathering card for about $500,000 and 18 sealed Alpha booster packs for roughly $1,512,500, alongside a first-edition Pokémon base set at about $750,000 and a sealed booster box at $257,500. He also paid about $601,545 for an Eid Mar Denarius, the ancient Roman coin struck to mark Julius Caesar's assassination, and $137,500 for a scrap of Wright brothers airplane fabric that Neil Armstrong carried to the moon. On-chain analytics had already followed part of the trail in January 2024: about 2.5 million BUSD moved from an address labeled as the Uranium exploiter, crossing from BNB Chain to Ethereum (ETH) through Li.fi, with the receiving address collecting 812 ETH and roughly $505,500 in stablecoins. Under a court-authorized warrant, investigators seized the Black Lotus card, the aircraft fabric and ancient coins from Spalletta's Maryland residence. Law enforcement separately seized cryptocurrency linked to the thefts on Feb. 24, 2025, assets worth about $31 million at the time of seizure. The office's announcement directs anyone who believes they were a victim of the hack to contact Homeland Security Investigations.

Sentencing Set for Feb. 16

The verdict shows how far recovery has come for victims of lone-wolf exploits. Mixing through Tornado Cash and converting stolen crypto into cards and antiquities did not put the funds beyond reach: agents seized about $31 million in crypto plus the collectibles themselves, and a restitution reckoning now awaits the Feb. 16 sentencing hearing, where the 20-year money laundering maximum gives the judge room. The failed “bug bounty” gambit is the other lesson, since prosecutors treated the retained $386,000 as evidence of intent rather than mitigation. The case also lands at a moment when DefiLlama data ranks the September Bitget breach, at $350 million, as 2026's largest hack. For anyone weighing decentralized venues against the Best Crypto Exchanges, the file from SDNY makes the tradeoff plain: audited contracts and accountable operators decide who is left holding losses.