"Crypto is just fake internet money anyway." That line, attributed to the defendant in court filings, underscored the indifference the U.S. Attorney said accompanied a theft that removed more than $53 million from a decentralized exchange and shut the platform down.
Who was convicted: Jonathan Spalletta and the charges
Thirty-six-year-old Jonathan Spalletta, who used the online aliases "Jspalletta" and "Cthulhon," surrendered to law enforcement on March 30 and was charged with computer fraud and money laundering. Court documents say prosecutors proved he twice exploited vulnerabilities in the decentralized exchange Uranium Finance in April 2021, extracting roughly $53.3 million in cryptocurrency and forcing the exchange to cease operations for lack of funds. He now faces statutory maximums of up to 10 years in prison for computer fraud and up to 20 years for money laundering.
How the breaches unfolded: two separate smart-contract exploits
The record lays out two distinct incidents in April 2021. On April 8, 2021, Spalletta allegedly exploited a flaw in Uranium's smart contract code to issue zero-token withdrawal commands that caused the exchange to pay rewards he was not entitled to; that action withdrew about $1.4 million from Uranium's liquidity pool. According to the filings, Spalletta then coerced the exchange into assigning a sham "bug bounty" of nearly $386,000 from the stolen funds as part of an attempt to cover or recover the theft.
Three weeks later, the court documents say he returned to exploit a separate coding error in Uranium's transaction-verification logic. That vulnerability reportedly caused the system to use 1,000 instead of 10,000 in a verification routine and allowed him to withdraw nearly 90% of assets held in Uranium's liquidity pools while depositing effectively zero tokens. That second exploit is credited with netting about $53.3 million—most of Uranium's holdings—and precipitating the exchange's immediate shutdown.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleMoney laundering through Tornado Cash and spending on collectibles
Prosecutors allege Spalletta laundered the proceeds through the Tornado Cash cryptocurrency mixer and multiple decentralized exchanges. Crypto fraud investigator ZachXBT is credited in the filings with first linking over 11,200 ETH withdrawn from Tornado Cash—worth $25 million at the time—to the Uranium attacker in December 2023.
Investigators say portions of the proceeds were converted into high-dollar collectibles. Reported purchases include 18 sealed packs of Alpha Booster Magic cards for about $1.5 million, a first-edition complete Pokémon base set for roughly $750,000, a "Black Lotus" Magic: The Gathering card for approximately $500,000, and an ancient Roman coin commemorating Julius Caesar's assassination for over $601,000, among other items. Law enforcement agents seized these collectibles from Spalletta's residence in February 2025 and reportedly recovered roughly $31 million in cryptocurrency from wallets linked to him.
U.S. Attorney Jamie McDonald’s statement and the human cost
U.S. Attorney Jamie McDonald was quoted as saying, "Spalletta's own words are indicative of his dangerously misguided indifference for his victims and the hardships he caused, saying: 'Crypto is just fake internet money anyway.' As Spalletta's many victims know, those words could not be further from the truth." McDonald emphasized that the crimes "cost real people to lose real money—over $50 million dollars—and caused an entire crypto platform to collapse."
What this means for technologists, policymakers, and affected users
- Technologists and security teams: The case centers on concrete smart-contract failures—zero-token withdrawal commands and a verification parameter using 1,000 instead of 10,000. Those specific failure modes will likely be examined by developers auditing automated market maker code and by teams responsible for pre-deployment verification.
- Policymakers and law enforcement: The laundering chain described—movement through a cryptocurrency mixer and decentralized exchanges, followed by conversion into high-value collectibles—illustrates the avenues prosecutors used to trace and recover assets, including a December 2023 public linkage by a crypto fraud investigator and seizures in February 2025.
- Affected users and exchange operators: Uranium Finance's immediate shutdown after the second exploit and the reported loss of most of its holdings highlight how a single logic error in verification routines can render a platform insolvent and harm depositors and counterparties.
The conviction brings criminal consequences into sharper relief for actors who exploit code-level flaws in decentralized finance. Prosecutors recovered a portion of the proceeds—roughly $31 million in cryptocurrency and seized collectibles—and a criminal verdict now stands against Spalletta, who faces decades of potential imprisonment under the statutes cited by the government. The record here ties particular coding mistakes to cascading financial loss, law enforcement tracing through mixers and exchanges, and an atypical portfolio of seized assets that included rare trading-card and numismatic purchases.
Original reporting: https://www.bleepingcomputer.com/news/security/uranium-crypto-exchange-hacker-found-guilty-of-53-million-theft/
