Maryland Man Charged in $50-54 Million Uranium Finance Hack

Federal prosecutors charged Maryland resident Jonathan Spalletta with computer fraud and money laundering for exploiting Uranium Finance twice in April 2021, stealing approximately $54.7 million total through smart contract vulnerabilities. Spalletta first drained $1.4 million on April 8, returning most funds but keeping $386,000 as a purported bug bounty, then exploited 26 liquidity pools on April 28 for $53.3 million, forcing the decentralized exchange to shut down. He laundered roughly $26 million through Tornado Cash over two years and purchased high-value collectibles including rare Pokémon cards and a Julius Caesar coin, traced by blockchain investigator ZachXBT. Law enforcement seized $31 million in crypto in February 2024, and Spalletta faces up to 30 years in prison, with prosecutors and security experts debating whether exploiting code vulnerabilities constitutes legal theft.

The Uranium Finance exploit and alleged perpetrator

• ▪Jonathan Spalletta exploited another flaw in Uranium Finance on April 28, 2021, across 26 liquidity pools, obtaining about $53.3 million in crypto
• ▪Jonathan Spalletta returned most of the stolen funds from the April 8, 2021 attack after negotiating with Uranium Finance but kept about $386,000 under what prosecutors describe as a sham bug bounty arrangement
• ▪The April 28, 2021 Uranium Finance exploit left Uranium Finance unable to continue operating
• ▪Jonathan Spalletta wrote to another individual roughly two weeks after the April 8, 2021 attack stating he did a crypto heist of $1.5 million by exploiting a bug in a smart contract
• ▪Jonathan Spalletta carried out a first attack on Uranium Finance on April 8, 2021, exploiting a rewards-tracking bug in Uranium's smart contracts to repeatedly drain a liquidity pool of approximately $1.4 million
• ▪Jonathan Spalletta faces a maximum of 10 years on the computer fraud count and 20 years on the money laundering charge
• ▪Jonathan Spalletta, also known as "Cthulhon" and "Jspalletta," was charged with computer fraud and money laundering in connection with two 2021 attacks on Uranium Finance

Money laundering and asset concealment tactics

• ▪Law enforcement seized crypto worth about $31 million in February 2024 that authorities say was tied to the Uranium Finance exploit scheme
• ▪Jonathan Spalletta funneled around $26 million through Tornado Cash between April 2021 and November 2023, moving funds across multiple blockchains and wallets to obscure their origin
• ▪ZachXBT traced the laundering trail in a December 2023 report, identifying how stolen ETH was withdrawn from the mixer and routed through brokers to purchase high-value collectibles

Legal implications for DeFi exploits and smart contract vulnerabilities

• ▪Angela Ang is head of policy and strategic partnerships for Asia Pacific at TRM Labs

Perspective of Jonathan Spalletta

• ▪Jonathan Spalletta negotiated to keep approximately $386,000 from the first Uranium Finance attack as a bug bounty payment
• ▪Jonathan Spalletta described his April 2021 activity to another individual as exploiting a bug in a smart contract