Maryland cybersecurity consultant Jonathan Spalletta has been convicted of computer fraud and money laundering for stealing nearly $55 million from Uranium Finance in April 2021. Spalletta used the stolen funds to purchase over $3 million in rare collectibles, including Pokémon cards, and laundered $26 million through Tornado Cash. Although federal authorities seized $31 million in 2025, the exchange collapsed. Spalletta faces up to 30 years in prison at his February 2027 sentencing.
The attacks on Uranium Finance
- ▪Uranium Finance ceased operations and shut down permanently following the April 28 exploit by Jonathan Spalletta
- ▪During the first attack on April 8, 2021, Jonathan Spalletta exploited Uranium Finance's reward mechanism to steal approximately $1.4 million
- ▪Jonathan Spalletta carried out two attacks against Uranium Finance in April 2021, stealing approximately $53.3 million in cryptocurrency on April 28 by exploiting 26 liquidity pools
Purchases of rare collectibles
- ▪Jonathan Spalletta used over $3 million of stolen Uranium Finance cryptocurrency to buy a $500,000 Black Lotus Magic: The Gathering card and first-edition Pokémon sets worth over $1 million
- ▪Jonathan Spalletta purchased a Roman "Eid Mar" coin for approximately $601,500 using the stolen Uranium Finance cryptocurrency
Trial and conviction of Jonathan Spalletta
- ▪On October 7, 2026, a Manhattan federal jury convicted Maryland cybersecurity consultant Jonathan Spalletta of computer fraud and money laundering
- ▪Jonathan Spalletta pleaded not guilty after being charged in March 2026, and his federal trial began on September 28, 2026
- ▪Jonathan Spalletta faces up to 30 years in prison, with sentencing scheduled for February 16, 2027
Implications for cryptocurrency tracing
- ▪The February 2025 seizure of $31 million from the $53 million stolen from Uranium Finance demonstrates that blockchain forensic tracing is effective but may not fully compensate victims of decentralized finance exploits
- ▪The October 7, 2026 conviction of Jonathan Spalletta, who used the online aliases "Cthulhon" and "Jspalletta," highlights that cryptocurrency pseudonymity does not prevent law enforcement from tracing transactions
Federal investigation
- ▪The fallout from the April 2021 Uranium Finance attacks by Jonathan Spalletta triggered a broad federal investigation into the destination of the stolen cryptocurrency
- ▪Federal investigators relied heavily on blockchain forensics to trace the path of the cryptocurrency stolen from Uranium Finance by Jonathan Spalletta
Seizure and charges
- ▪Federal authorities seized approximately $31 million in cryptocurrency from Jonathan Spalletta in February 2025 using blockchain forensics
- ▪Jonathan Spalletta surrendered to federal authorities on the same day he was charged in March 2026
Money laundering
- ▪Federal prosecutors alleged that Jonathan Spalletta laundered stolen Uranium Finance funds between 2021 and 2023, routing approximately $26 million through the crypto mixer Tornado Cash
- ▪The money laundering charge against Jonathan Spalletta carries a maximum penalty of 20 years in prison
Debatable claims
- ▪Courts should impose maximum prison sentences for decentralized finance exploits
- ▪Blockchain forensic tracing is sufficient to protect decentralized finance participants
- ▪Decentralized finance platforms bear primary responsibility for user losses from exploits
- ▪Exploiting smart contract vulnerabilities is morally equivalent to theft
Story comments
Loading comments…