A Manhattan jury has convicted Jonathan Spalletta of computer fraud and money laundering for carrying out two 2021 hacks of the decentralized crypto exchange Uranium Finance that drained more than $50 million, federal prosecutors said Wednesday. The verdict treats an exploit executed entirely through transactions against a smart contract — the self-executing code that settles trades on decentralized exchanges — as conventional computer fraud, a framing prosecutors themselves highlighted in announcing the conviction.

Spalletta, 36, of Rockville, Maryland, was charged over the exploits in March. He was found guilty on all counts after a six-day trial before U.S. District Judge Jed S. Rakoff and faces a maximum sentence of 10 years in prison for computer fraud and 20 years for money laundering, with sentencing before Rakoff still to come.

The U.S. Attorney's Office for the Southern District of New York announced the verdict in a post on X:

Jonathan Spalletta convicted for defrauding crypto exchange of over $50 million in hacks: "Our prosecutors of the Office and our agency partners have done outstanding work to ensure Spaletta's virtual world criminal conduct ended in his real-world criminal conviction," said USA… — US Attorney SDNY (@SDNYnews) October 7, 2026

Two Exploits Three Weeks Apart

In the first hack, on April 8, 2021, Spalletta repeated a series of transactions with Uranium's smart contract to withdraw far more rewards than he was entitled to, taking about $1.4 million, according to prosecutors. He then pressured the exchange into letting him keep roughly $386,000 as what prosecutors called a sham "bug bounty" — a reference to the industry practice of paying researchers who disclose vulnerabilities in good faith — in exchange for returning the rest.

Two weeks after that hack, he wrote to another person: "I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway."

On April 28, 2021, he exploited an error in how the contract calculated withdrawals across several liquidity pools — the shared reserves of user-deposited funds that decentralized exchanges rely on to facilitate trading — taking about $53.3 million and causing Uranium to shut down for lack of funds.

"Spalletta's crimes cost real people to lose real money—over $50 million dollars—and caused an entire crypto platform to collapse," said U.S. Attorney Jamie McDonald.

Black Lotus, Pokémon Cards and a Roman Coin

Spalletta laundered the stolen funds through a series of transactions, including the crypto mixing service Tornado Cash, which pools and shuffles coins to obscure their origin, before spending the proceeds on collectibles including Magic: The Gathering and Pokémon cards, prosecutors said.

His Magic: The Gathering purchases included a Black Lotus, among the most sought-after cards in the game, for about $500,000, as well as 18 sealed packs of Alpha Booster cards from the game's 1993 debut set for about $1.5 million. On the Pokémon side, he paid about $750,000 for a first edition complete base set from the card game's original release and about $257,500 for a sealed box of first edition booster packs.

He also bought an Eid Mar denarius — a Roman coin minted in 42 B.C. under Brutus to commemorate the assassination of Julius Caesar — for about $601,545, and a piece of fabric from the Wright brothers' original airplane that Neil Armstrong carried to the moon, for about $137,500.

The Black Lotus, the fabric and some of the coins were seized from his home under a search warrant, according to prosecutors. In February 2025, authorities also seized cryptocurrency from the Uranium hacks worth about $31 million at the time of seizure — a recovery that came despite the obfuscation the mixing-service step was designed to provide.

Prosecutors have asked anyone who believes they were a victim of the Uranium hacks to contact Homeland Security Investigations at UraniumVictims@hsi.dhs.gov, outreach that signals authorities are still working to identify everyone affected by the exploits.

The full announcement from the U.S. Attorney's Office for the Southern District of New York is available on the Department of Justice website. Sentencing before Rakoff will be the next milestone in a case that began with two exploits three weeks apart in the spring of 2021.