Stealing $53.4 million, turning around and throwing $500,000 onto a single deck of cards 🃏
📈 进群看今日思路
A 36-year-old man from Maryland, USA, Jonathan Spalletta, twice drilled into the same smart contract vulnerability in a decentralized exchange platform, netting more than $50 million in total. On Wednesday, a federal jury in Manhattan found him guilty of computer fraud and illegal transfer of proceeds from unlawful activity. In front of him sat the maximum penalty of up to 10 years for computer fraud, plus another up to 20 years 🦖
First, look at the timeline. On April 8, 2021, he repeatedly called the contract in a loop, over-withdrawing about $1.4 million, and then repackaged about $386,000 as a vulnerability bounty to force the platform to admit it—using that to get back the remaining money. In a letter, he bragged that two weeks earlier he had pulled off a $1.5 million crypto robbery, and added: “Anyway, cryptocurrencies are all fake—network money.”
The real heavy blow came on April 28. He exploited a contract pricing error across multiple liquidity pools and pulled out about $53.4 million in one go. The platform shut down immediately because it had no money left ⚖️
Where did the money go? First, he ran the funds through a mixer, Tornado Cash. Then he started buying collectibles: a Magic: The Gathering Black Lotus worth about $500,000; 18 packs of the original edition supplement packs worth about $1.5 million; a full set of original-edition Pokémon base cards worth about $750,000; a full box of original-edition Pokémon supplement packs worth about $257,500; and a commemorative Roman silver coin marking Caesar’s assassination worth about $601,500. There was also a small piece of fabric from a hat—part of the Wright brothers’ plane on the Moon mission—worth about $137,500.
My take: the most worth examining here isn’t the sky-high cards—it’s the on-chain trail with no mercy. He thought the mixer could erase the evidence. Instead, law enforcement seized, in one operation in February 2025, crypto assets then worth about $31 million. After a six-day trial, all charges were found guilty. From $1.4 million to $53.4 million, every step left footprints on-chain 🐋
A reminder for ordinary coin holders, too: once the pricing logic of a smart contract has a loophole, draining the funds may require only a single transaction. And anonymity has never been absolute—only relative.
Do you think cases like this—big money on-chain—can really hide funds with a mixer? Chat in the comments.
Every day, I’ll take you through the crypto industry’s hottest topics. Not just what happened in the news, but also the logic and opportunities behind it 👀🚀
Click the profile picture to watch the live stream
📈 进群看今日思路
A 36-year-old man from Maryland, USA, Jonathan Spalletta, twice drilled into the same smart contract vulnerability in a decentralized exchange platform, netting more than $50 million in total. On Wednesday, a federal jury in Manhattan found him guilty of computer fraud and illegal transfer of proceeds from unlawful activity. In front of him sat the maximum penalty of up to 10 years for computer fraud, plus another up to 20 years 🦖
First, look at the timeline. On April 8, 2021, he repeatedly called the contract in a loop, over-withdrawing about $1.4 million, and then repackaged about $386,000 as a vulnerability bounty to force the platform to admit it—using that to get back the remaining money. In a letter, he bragged that two weeks earlier he had pulled off a $1.5 million crypto robbery, and added: “Anyway, cryptocurrencies are all fake—network money.”
The real heavy blow came on April 28. He exploited a contract pricing error across multiple liquidity pools and pulled out about $53.4 million in one go. The platform shut down immediately because it had no money left ⚖️
Where did the money go? First, he ran the funds through a mixer, Tornado Cash. Then he started buying collectibles: a Magic: The Gathering Black Lotus worth about $500,000; 18 packs of the original edition supplement packs worth about $1.5 million; a full set of original-edition Pokémon base cards worth about $750,000; a full box of original-edition Pokémon supplement packs worth about $257,500; and a commemorative Roman silver coin marking Caesar’s assassination worth about $601,500. There was also a small piece of fabric from a hat—part of the Wright brothers’ plane on the Moon mission—worth about $137,500.
My take: the most worth examining here isn’t the sky-high cards—it’s the on-chain trail with no mercy. He thought the mixer could erase the evidence. Instead, law enforcement seized, in one operation in February 2025, crypto assets then worth about $31 million. After a six-day trial, all charges were found guilty. From $1.4 million to $53.4 million, every step left footprints on-chain 🐋
A reminder for ordinary coin holders, too: once the pricing logic of a smart contract has a loophole, draining the funds may require only a single transaction. And anonymity has never been absolute—only relative.
Do you think cases like this—big money on-chain—can really hide funds with a mixer? Chat in the comments.
Every day, I’ll take you through the crypto industry’s hottest topics. Not just what happened in the news, but also the logic and opportunities behind it 👀🚀
Click the profile picture to watch the live stream