A Manhattan federal jury convicted Jonathan Spalletta on Wednesday of computer fraud and money laundering in connection with the 2021 Uranium Finance attacks. Jurors returned guilty verdicts on both counts after beginning deliberations Tuesday afternoon.
Prosecutors alleged that Spalletta exploited vulnerabilities in Uranium Finance, a decentralized finance platform on BNB Chain, to drain approximately $53.3 million in cryptocurrency.
The Exploits
The first incident occurred on April 8, 2021, when Spalletta allegedly exploited a rewards-distribution flaw and took about $1.4 million before returning roughly $1 million under what authorities characterized as a sham bug bounty.
The larger theft came on April 28, 2021, when Spalletta allegedly exploited a faulty mathematical check in Uranium's version 2.1 contracts that omitted a critical zero in calculations. Prosecutors said he leveraged this flaw across 26 liquidity pools to extract approximately $53.3 million.
Money Laundering and Spending Spree
Approximately $26 million moved through Tornado Cash, an ether mixing service, between April 2021 and November 2023, according to prosecutors. Blockchain investigators traced millions emerging from the mixer in 100 ETH chunks and being converted into collectibles.
The indictment details substantial purchases including a rare "Black Lotus" Magic: The Gathering card for approximately $500,000, 18 sealed Alpha Booster Magic packs for roughly $1.51 million, and a first-edition Pokémon card base set for about $750,000. Additional purchases included a first-edition Pokémon booster box for $257,500, a Roman Eid Mar coin commemorating Julius Caesar's assassination for roughly $601,545, and fabric from the Wright brothers' airplane for approximately $137,500.
Defense and Verdict
Spalletta's defense centered on attribution, arguing prosecutors could not prove who actually executed the exploits and that Tornado Cash is a legitimate privacy tool. The jury rejected these arguments on both counts.
Sentencing and Asset Recovery
U.S. District Judge Jed S. Rakoff declined to impose additional monitoring conditions pending sentencing. The computer fraud charge carries a statutory maximum of 10 years, while money laundering carries a maximum of 20 years. Federal agents seized approximately $31 million in cryptocurrency in February 2025, along with collectibles including the Black Lotus card and Wright brothers fabric. No sentencing date has been scheduled.
