A Maryland man was found guilty of stealing more than $53 million after hacking the decentralized crypto exchange Uranium Finance twice in April 2021.
36-year-old Jonathan Spalletta (also known online as “Jspalletta” and “Cthulhon”) surrendered to law enforcement on March 30 and was charged with computer fraud and money laundering.
According to court documents, Spalletta hacked Uranium (an automated market maker on Binance’s BNB Chain) and stole nearly $53.3 million in cryptocurrency, forcing the company to shut down for lack of funds.
On April 8, 2021, during the first breach, he drained drained about $1.4 million out of Uranium’s liquidity pool by exploiting a flaw in its smart contract code to issue zero-token withdrawal commands, which forced the exchange to pay rewards he wasn’t entitled to.
Spalletta then extorted the crypto exchange into assigning a sham “bug bounty” of nearly $386,000 from the stolen funds to get the rest back.
Three weeks later, he hit Uranium again, exploiting a separate coding error that caused the exchange’s transaction-verification logic to use 1,000 instead of 10,000 and allowed him to withdraw nearly 90% of the assets held in Uranium’s liquidity pools while depositing effectively zero tokens.
This netted Spalletta about $53.3 million (most of Uranium’s holdings) and forced the crypto exchange to shut down immediately. Next, Spalletta laundered the stolen cryptocurrency through the Tornado Cash cryptocurrency mixer and multiple decentralized exchanges.
The proceeds were spent buying 18 sealed packs of Alpha Booster Magic cards for around $1.5 million, a first-edition complete Pokémon base set for roughly $750,000, a “Black Lotus” Magic: The Gathering card for approximately $500,000, an ancient Roman coin commemorating Julius Caesar’s assassination for over $601,000, among other items.
Law enforcement agents seized these collectibles from his residence in February 2025 and recovered roughly $31 million in cryptocurrency from crypto wallets linked to Spalletta.
Crypto fraud investigator ZachXBT first linked over 11,200 ETH withdrawn from Tornado Cash (worth $25 million at the time) to the Uranium hacker in December 2023.
“Spalletta’s own words are indicative of his dangerously misguided indifference for his victims and the hardships he caused, saying: ‘Crypto is just fake internet money anyway.’ As Spalletta’s many victims know, those words could not be further from the truth,” U.S. Attorney Jamie McDonald said on Wednesday.
“Spalletta’s crimes cost real people to lose real money—over $50 million dollars—and caused an entire crypto platform to collapse.”
Spalletta now faces up to 10 years in prison for computer fraud and up to 20 years for money laundering.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.