Key Highlights
- Jonathan Spalletta was convicted of stealing about $54.7 million from Uranium Finance in two hacks in 2021.
- He exploited smart contract flaws, stealing $1.4 million in the first attack and about $53.3 million in the second, forcing Uranium Finance to shut down.
- Authorities later seized about $31 million in stolen crypto, while Spalletta also used part of the money to buy expensive collectibles, including rare Magic and Pokémon cards.
Jonathan Spalletta, also known as “Cthulhon” and “Jspalletta,” has been convicted by a U.S. jury for stealing about $54.7 million from decentralized crypto exchange Uranium Finance in two hacks carried out in April 2021.
According to the official Department of Justice (DOJ) release dated October 7, the 36-year-old was found guilty of computer fraud and money laundering after prosecutors said he used flaws in Uranium’s smart contracts to take the funds.
Spalletta was convicted on all counts after a six-day trial before U.S. District Judge Jed S. Rakoff in Manhattan. The conviction marks a development in a case that began more than five years ago, when Uranium Finance was hit by two attacks that drained its funds and eventually forced the platform to shut down.
U.S. Attorney Jamie McDonald said Spalletta repeatedly found weaknesses in Uranium’s code and used them to steal money from the platform. He also pointed to Spalletta’s own words after the first attack, when he described cryptocurrency as “fake internet money.” McDonald said the losses were real for the people who lost their money and that the attacks caused the entire platform to collapse.
The first attack took $1.4 million
Uranium Finance allowed users to deposit and exchange different cryptocurrencies through liquidity pools. These pools held funds that users could trade or use on the platform. On April 8, 2021, Spalletta reportedly found a weakness in Uranium’s smart contract that controlled its rewards system. He used a series of transactions to collect far more rewards than he was supposed to receive.
He repeated the process until he had taken almost all the reward tokens in the pool. The cryptocurrency he obtained in the first attack was about $1.4 million.
About two weeks later, Spalletta told another person that he had carried out a crypto heist worth about $1.5 million. He said there was a bug in a smart contract and that he had exploited it. He later reportedly made an arrangement with Uranium that allowed him to keep about $386,000 as a supposed bug bounty while returning the rest of the money. Prosecutors described the deal as a sham arrangement meant to help him avoid prosecution.
The second attack was far bigger
Just 20 days after the first attack, Spalletta struck Uranium Finance again. On April 28, 2021, he reportedly exploited another error in the exchange’s smart contract. This flaw affected the amount of cryptocurrency that could be withdrawn from its liquidity pools.
Spalletta used the weakness across multiple pools and obtained about $53.3 million in cryptocurrency. The loss left Uranium without enough funds to continue operating, forcing the platform to shut down.
Together, the two attacks accounted for about $54.7 million in stolen cryptocurrency.
The stolen crypto was moved
After taking the funds, Spalletta moved them through a complex series of cryptocurrency transactions. Prosecutors said he used Tornado Cash, a crypto mixer that can make transactions harder to trace, according to a DOJ release from March 2026.
The stolen money did not simply sit in a wallet. Some of it was turned into expensive collectibles.
Authorities said Spalletta bought a Black Lotus Magic: The Gathering card for about $500,000 and 18 sealed Alpha Booster packs for roughly $1.51 million. He also bought first-edition Pokémon cards, including a complete base set worth about $750,000.
His purchases went beyond trading cards. He spent about $601,545 on an antique Roman coin linked to the assassination of Julius Caesar. He also bought a piece of fabric from the Wright brothers’ airplane that was later taken to the moon by astronaut Neil Armstrong.
Authorities later recovered $31 million
The investigation continued long after the 2021 attacks. On February 24, 2025, law enforcement seized cryptocurrency worth about $31 million at the time of the seizure that authorities linked to the Uranium theft.
Investigators also seized some of the collectibles from Spalletta’s home through a court-approved search warrant.
Spalletta now faces a maximum sentence of 10 years for computer fraud and 20 years for money laundering. Those are the maximum penalties set by law, and his actual sentence will be decided by the judge.
Also Read: Crypto Trader Frogman Loses Over $4M in Wallet Hack in Singapore During TOKEN2049′
