A Manhattan federal jury has convicted Jonathan Spalletta, a Maryland cybersecurity consultant, for draining roughly $54.7 million from the decentralized exchange Uranium Finance in two April 2021 hacks.
The case reads like a crypto-meets-collectibles fever dream: stolen funds ran through Tornado Cash, then went into one of the most expensive Magic: The Gathering cards in existence, a first-edition Pokémon set, a Roman coin, and a scrap of fabric that traveled to the moon.
The Verdict
On Wednesday, October 7, a jury found Spalletta, 36, of Rockville, Maryland, guilty on both counts of computer fraud and money laundering after a six-day trial before U.S. District Judge Jed Rakoff. Computer fraud carries a maximum of 10 years in prison and money laundering up to 20. Online, Spalletta went by “Cthulhon” and “Jspalletta.”
U.S. Attorney Jamie McDonald said:
“Spalletta’s crimes cost real people to lose real money, over $50 million dollars, and caused an entire crypto platform to collapse.” The Southern District of New York added that its prosecutors and agency partners had ensured his “virtual world criminal conduct ended in his real-world criminal conviction.”
Hack One: A Bug and a “Bounty”
Uranium Finance was a decentralized exchange where users swapped tokens through liquidity pools. According to prosecutors, Spalletta struck on April 8, 2021, by repeating a series of transactions against Uranium’s smart contract to pull out far more rewards than he was owed, taking about $1.4 million.
He then pressed the team to let him keep roughly $386,000 as a “bug bounty” in exchange for returning the rest. Prosecutors called that bounty a sham. Two weeks later, he wrote to another person:
“I did a crypto heist of $1.5MM a couple of weeks ago… There was a bug in a smart contract, and I exploited it… Crypto is all fake internet money anyway.”
Hack Two: The $53.3 Million Strike
Just 20 days after the first attack, on April 28, 2021, he hit again. This time he exploited an error in how the contract calculated withdrawals across several liquidity pools, taking about $53.3 million. Uranium could not survive the loss and shut down for lack of funds.
“Code Is Law” Didn’t Work
Spalletta’s lawyers argued that prosecutors could not prove “whose fingers were on the keyboard,” that he did not write Uranium’s faulty code, and that Tornado Cash is simply a privacy tool. The jury rejected those arguments. Cryptopolitan reported the verdict came after roughly two hours of deliberation. After the verdict, prosecutors asked for GPS monitoring of Spalletta.
Laundering Through Tornado Cash
Prosecutors said Spalletta moved the proceeds through a chain of transactions that included Tornado Cash, the Ethereum mixing service designed to obscure where funds come from and where they go. Reporting on the trial put about $26 million of it through the mixer between April 2021 and November 2023.
The Shopping List
What turned this into a headline-grabber is where the money went. According to the Justice Department and trial evidence:
– Magic: The Gathering: a Black Lotus card for about $500,000, plus 18 sealed Alpha Booster packs for roughly $1.5 million
– Pokémon: a complete first-edition base set for about $750,000 and a sealed first-edition booster box for about $257,500
– Ancient history: an Eid Mar denarius, the Roman coin commemorating Julius Caesar’s assassination, for about $601,545
– Space memorabilia: a piece of fabric from the Wright brothers’ original airplane, carried to the moon by Neil Armstrong, for about $137,500
That is a lot of cardboard and fabric, and it happens to rhyme with a trend crypto readers have noticed lately: Pokémon cards have been outperforming Bitcoin in 2026, and Coinbase recently announced a Pokémon pack product.
What the Government Got Back
Investigators seized the Black Lotus, the Wright brothers fabric and some of the coins from Spalletta’s home under a court-authorized search warrant. In February 2025, authorities also seized cryptocurrency from the Uranium hacks worth about $31 million at the time. Prosecutors have asked anyone who believes they were a victim of the Uranium hacks to contact Homeland Security Investigations.
Why Crypto Users Should Care
This case lands in a year when DeFi security has been brutal, with hundreds of millions lost to exploits across exchanges and protocols. It is a reminder of three things:
1. Exploits are prosecutable. The “the code allowed it” argument failed in front of a jury, even though the contract’s logic really was flawed.
2. A “bug bounty” is not a free pass. Returning part of the loot after taking it did not shield him.
3. Mixers don’t erase the trail. The money moved through Tornado Cash, yet investigators still traced it to assets sitting in his home and to $31 million in seized crypto.
For Uranium’s users and team, the damage was permanent: the exchange never recovered.
What Comes Next
Spalletta’s sentencing date has not been reported in the coverage I found. With convictions on both counts, he faces a potential total of 30 years in prison, though actual sentences are typically lower. For now, the case stands as a cautionary tale in the “what happens after the hack” chapter of DeFi: the code was exploited in minutes, but the consequences took more than five years to arrive.