U.S. indictment alleges two Uranium Finance crypto exploits moved through Tornado Cash before being used to buy Pokemon cards and other collectibles. The charges against Jonathan Spalletta remain allegations, not a court finding of guilt.
The U.S. Department of Justice indictment announcement, issued on March 30, 2026, describes the alleged hacks, laundering route, and purchases.
Uranium was a decentralized cryptocurrency exchange that let users deposit and exchange assets through liquidity pools. Prosecutors allege that Spalletta exploited its smart contracts twice in April 2021, turning weaknesses in withdrawal and rewards logic into substantial losses for the exchange and its users.
The first alleged attack took place on April 8. The indictment says a deceptive sequence of smart-contract transactions let Spalletta withdraw more rewards tokens than he was entitled to receive, extracting cryptocurrency worth approximately $1.4 million. It further alleges that he repeated the transactions until he had drained nearly all the rewards tokens in the pool.
On April 28, prosecutors allege, he exploited a separate error affecting withdrawals across 26 Uranium liquidity pools, resulting in the theft of approximately $53.3 million in crypto. The exchange shut down after the second hack because it lacked funds. Those figures are the DOJ's account of two distinct attacks; the release does not establish a separate, definitive combined total beyond describing the charges as involving more than $50 million.
The case has moved well beyond the original exploit. The DOJ said Spalletta surrendered after the indictment was unsealed on March 30, 2026, and was due to appear before U.S. Magistrate Judge Ona T. Wang. Separately, law enforcement seized cryptocurrency worth approximately $31 million on February 24, 2025, under a judicially authorized seizure warrant.
That long gap between the alleged 2021 attacks and the later seizure is familiar in crypto enforcement: transactions can remain visible even when the identity behind an address is not immediately established.
$GRVT
The U.S. Department of Justice indictment announcement, issued on March 30, 2026, describes the alleged hacks, laundering route, and purchases.
Uranium was a decentralized cryptocurrency exchange that let users deposit and exchange assets through liquidity pools. Prosecutors allege that Spalletta exploited its smart contracts twice in April 2021, turning weaknesses in withdrawal and rewards logic into substantial losses for the exchange and its users.
The first alleged attack took place on April 8. The indictment says a deceptive sequence of smart-contract transactions let Spalletta withdraw more rewards tokens than he was entitled to receive, extracting cryptocurrency worth approximately $1.4 million. It further alleges that he repeated the transactions until he had drained nearly all the rewards tokens in the pool.
On April 28, prosecutors allege, he exploited a separate error affecting withdrawals across 26 Uranium liquidity pools, resulting in the theft of approximately $53.3 million in crypto. The exchange shut down after the second hack because it lacked funds. Those figures are the DOJ's account of two distinct attacks; the release does not establish a separate, definitive combined total beyond describing the charges as involving more than $50 million.
The case has moved well beyond the original exploit. The DOJ said Spalletta surrendered after the indictment was unsealed on March 30, 2026, and was due to appear before U.S. Magistrate Judge Ona T. Wang. Separately, law enforcement seized cryptocurrency worth approximately $31 million on February 24, 2025, under a judicially authorized seizure warrant.
That long gap between the alleged 2021 attacks and the later seizure is familiar in crypto enforcement: transactions can remain visible even when the identity behind an address is not immediately established.
$GRVT