A federal jury in Manhattan has convicted Jonathan Spalletta, a 36-year-old cybersecurity consultant from Rockville, Maryland, of computer fraud and money laundering over the theft of roughly $55 million from the decentralised finance protocol Uranium Finance in April 2021. The verdict, delivered on October 7 after a six-day trial, closes a case that began with two separate attacks on the protocol's liquidity pools.
The first attack, on April 8, 2021, netted approximately $1.4 million. Spalletta returned part of the funds but kept around $386,000, which he framed as a bug bounty. Prosecutors described the arrangement simply as a \"bounty\" rather than a legitimate security disclosure. Three weeks later, on April 28, 2021, a second and far larger attack hit 26 of the protocol's reserves, draining approximately $53.3 million. Combined, the two incidents accounted for roughly $54.7 million taken from the platform before any repayment, and the losses from the second attack forced Uranium Finance to shut down entirely.
Spalletta's defence argued the exploit did not involve stolen credentials or malicious code, suggesting the manipulation relied on flaws inherent to the protocol's design rather than conventional hacking tools. The jury was not persuaded. The court's characterisation of the conduct centred on the \"exploitation of the vulnerabilities and laundering of the funds,\" tying the technical intrusion directly to what followed: a sustained effort to move the stolen cryptocurrency through Tornado Cash, the mixing service repeatedly used in major DeFi theft cases to obscure the trail of funds.
From blockchain to collectibles
Rather than leaving the proceeds in crypto, Spalletta converted a significant portion into physical collectibles. Purchases included a Black Lotus Magic: The Gathering card worth approximately $500,000, 18 sealed Alpha-edition card packs bought for around $1.5 million, and a first-edition Pokémon card set acquired for $750,000. He also spent more than $600,000 on a Roman coin commemorating the assassination of Julius Caesar and roughly $137,500 on a fragment of fabric from the Wright brothers' aircraft that had been carried to the Moon by Neil Armstrong.
Separately from these acquisitions, authorities seized $31 million in cryptocurrency linked to Spalletta, valued at the time of seizure in February 2025.
Sentencing before Judge Jed Rakoff is scheduled for February 16, 2027. The computer fraud charge carries a maximum of 10 years in prison, while the money laundering count carries a maximum of 20 years. For a sector that has watched successive DeFi exploits vanish into mixers and shell transactions, the case stands out for how openly the stolen funds ultimately surfaced, in the form of cardboard packs, ancient coins and a relic of early aviation history.
