A Manhattan federal jury has convicted Jonathan Spalletta, a 36-year-old cybersecurity consultant from Rockville, Maryland, on charges of computer fraud and money laundering tied to two 2021 attacks on the BNB Chain-based automated market maker Uranium Finance.
The verdict followed a six-day trial before U.S. District Judge Jed Rakoff. Spalletta was found guilty on both counts after jurors deliberated for more than two hours. The computer fraud count carries a maximum prison term of 10 years, while the money laundering count carries up to 20 years, with sentencing scheduled for Feb. 16.
According to the U.S. Attorney’s Office for the Southern District of New York, the first attack occurred on April 8, 2021, when Spalletta repeatedly executed transactions against a rewards smart contract, withdrawing approximately $1.4 million in rewards tokens. He later returned most of those funds while keeping about $386,000 under what prosecutors called a sham bug bounty arrangement. On April 28, 2021, he exploited a missing zero in a balance validation check in Uranium Finance’s version 2.1 smart contracts, draining 26 liquidity pools and taking roughly $53.3 million. The combined losses of nearly $55 million forced the protocol to shut down.
Prosecutors said Spalletta laundered about $26 million through the privacy mixer Tornado Cash between April 2021 and November 2023. On-chain investigator ZachXBT tracked fractional transfers of 100 ETH that were later converted to fiat currency and used for private purchases, including rare collectibles.
Among the acquisitions cited in court records were a Magic: The Gathering Black Lotus card bought for about $500,000, 18 sealed Alpha Booster packs costing approximately $1,512,500, a sealed first-edition Pokémon booster box for about $257,500, a complete first-edition Pokémon base set valued at around $750,000, an Eid Mar Denarius Roman coin commemorating the assassination of Julius Caesar for about $601,545, and a piece of fabric from the Wright brothers’ airplane that Neil Armstrong later carried to the moon for $137,500.
In February 2025, authorities seized approximately $31 million in cryptocurrency linked to the theft, along with physical collectibles from Spalletta’s Maryland residence. Bloomberg reported that the rare Pokémon and Magic: The Gathering cards seized from the home were worth more than $3 million. Victims have been directed to contact Homeland Security Investigations.
During the trial, defense lawyers argued there was no direct proof of who was behind the keyboard and that Spalletta had used publicly available smart contract functions rather than malicious code. Prosecutors countered with on-chain evidence and a message in which Spalletta wrote: “I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway.” The case was assigned to the office’s Complex Frauds and Cybercrime Unit, and Spalletta was identified by the online aliases “Cthulhon” and “Jspalletta.”
