Key Points
- Federal authorities have indicted Jonathan Spalletta, 36, from Rockville, Maryland, on charges of computer fraud and money laundering
- The defendant allegedly executed two separate attacks on Uranium Finance during April 2021, extracting more than $50 million
- The stolen funds were allegedly cleaned through Tornado Cash before being converted into high-value collectible items
- Federal agents recovered $31 million in cryptocurrency connected to the exploits during February 2025
- Combined charges could result in a maximum prison sentence of 30 years upon conviction
Federal prosecutors have brought charges against Jonathan Spalletta, a 36-year-old from Maryland, for orchestrating two separate cyberattacks against the decentralized exchange Uranium Finance during April 2021, resulting in losses exceeding $50 million.
The Southern District of New York unsealed the criminal indictment on Monday. Spalletta turned himself in to federal authorities in Manhattan that same day, appearing before U.S. Magistrate Ona Wang for his initial hearing.
Uranium Finance operated as a BNB Chain adaptation of the popular automated market maker Uniswap. The platform began operations in April 2021 and ceased activity within weeks of the security breaches after depleting available resources.
The initial security breach took place on April 8, 2021, mere days following the platform’s debut. According to prosecutors, Spalletta identified and exploited a vulnerability within Uranium’s reward distribution system, enabling unauthorized withdrawals that netted approximately $1.4 million.
Following the initial incident, the parties entered into a private settlement. Prosecutors characterize the arrangement as a fraudulent “bug bounty” agreement through which Spalletta returned a portion of the stolen assets while retaining approximately $386,000.
The subsequent and significantly larger breach occurred on April 28, 2021. Spalletta allegedly manipulated a coding flaw in the smart contract that controlled withdrawal restrictions across 26 separate liquidity pools, extracting $53.3 million worth of digital assets including Bitcoin, Ether, and the platform’s native U92 token.
After the second security breach, Uranium Finance discontinued its online operations, leaving affected users with minimal information regarding the incident or the perpetrator’s identity.
During February 2025, law enforcement agencies confiscated roughly $31 million in digital currency linked to the attacks. The seizure occurred without public disclosure of any suspect information.
Tracing the Stolen Assets
According to the prosecution, Spalletta allegedly channeled the stolen cryptocurrency through an elaborate network of transactions, utilizing Tornado Cash, a privacy-focused cryptocurrency mixing protocol.
The funds were subsequently converted into premium collectible items. Among the purchases was a Black Lotus Magic: The Gathering card acquired for approximately $500,000, along with 18 unopened Alpha booster packs totaling roughly $1.5 million.
Additional alleged acquisitions included first-edition Pokémon card sets valued at over $1 million, an ancient Roman “Eid Mar” coin purchased for about $601,500, and a fragment of fabric from the Wright brothers’ historic aircraft. Law enforcement recovered these items during a search of his home.
Messages referenced in the indictment show Spalletta telling an acquaintance: “I did a crypto heist … Crypto is all fake internet money anyway.”
Criminal Charges and Potential Penalties
Spalletta stands accused of one count of computer fraud, carrying a maximum sentence of 10 years imprisonment, alongside one count of money laundering, which carries a maximum sentence of 20 years.
U.S. Attorney Jay Clayton stated: “Stealing from a crypto exchange is stealing — the claim that ‘crypto is different’ does not change that.”
This prosecution represents the first instance where federal authorities have publicly identified a specific individual in connection with the Uranium Finance breaches, more than four years following the original incidents.
