Key Points
- Federal authorities have indicted Jonathan Spalletta, 36, from Rockville, Maryland, on charges of computer fraud and money laundering
- The accused allegedly executed two separate attacks on Uranium Finance in April 2021, draining more than $50 million in digital assets
- Stolen funds were allegedly cleaned through Tornado Cash and converted into high-value collectible items
- Federal agents confiscated approximately $31 million in cryptocurrency connected to the attacks in February 2025
- If found guilty on all charges, Spalletta could receive a maximum sentence of 30 years behind bars
Federal prosecutors have brought charges against Jonathan Spalletta, a 36-year-old from Maryland, alleging he orchestrated two separate cyberattacks on the decentralized finance platform Uranium Finance during April 2021, resulting in losses exceeding $50 million.
The criminal indictment was made public by the Southern District of New York this past Monday. Spalletta voluntarily surrendered to law enforcement in Manhattan on the same date and made his initial court appearance before U.S. Magistrate Ona Wang.
Uranium Finance operated as a BNB Chain adaptation of the popular automated market maker protocol Uniswap. The platform went live in April 2021 but ceased operations soon after the exploits due to depleted resources.
The initial breach took place on April 8, 2021, mere days following the platform’s debut. According to allegations, Spalletta manipulated a vulnerability in Uranium’s reward distribution system to extract significantly more digital currency than permitted, netting approximately $1.4 million.
Following the initial incident, a private settlement was arranged. Spalletta participated in negotiations for what authorities characterize as a fraudulent “bug bounty” agreement, returning the majority of stolen assets while retaining roughly $386,000.
The subsequent and more substantial breach occurred on April 28, 2021. Prosecutors claim Spalletta took advantage of a smart contract flaw affecting withdrawal restrictions across 26 separate liquidity pools, extracting $53.3 million in various cryptocurrencies including Bitcoin, Ether, and the platform’s proprietary token U92.
In the aftermath of the second incident, Uranium Finance took down its online presence, leaving affected users with minimal information regarding the circumstances or the identity of the perpetrator.
In February 2025, law enforcement officials confiscated roughly $31 million in digital currency linked to the breaches. At that juncture, no information was disclosed concerning a potential suspect.
The Trail of Stolen Assets
According to prosecutors, Spalletta allegedly cleaned the stolen digital assets through an intricate network of transactions, utilizing Tornado Cash, a cryptocurrency obfuscation protocol.
He subsequently allegedly converted the illicit gains into premium collectible items. Among the purchases was a Black Lotus Magic: The Gathering card valued at approximately $500,000, along with 18 unopened Alpha edition booster packs totaling roughly $1.5 million.
Additional alleged acquisitions included first-edition Pokémon collections exceeding $1 million in value, an ancient Roman “Eid Mar” coin purchased for about $601,500, and a fragment of fabric from the Wright brothers’ historic aircraft. These items were recovered during a law enforcement search of his home.
According to communications referenced in the indictment, Spalletta allegedly told an acquaintance: “I did a crypto heist … Crypto is all fake internet money anyway.”
Legal Consequences
Spalletta has been charged with one count of computer fraud, punishable by up to 10 years imprisonment, and one count of money laundering, which carries a maximum penalty of 20 years.
U.S. Attorney Jay Clayton stated: “Stealing from a crypto exchange is stealing — the claim that ‘crypto is different’ does not change that.”
These charges represent the first instance of a publicly identified suspect being connected to the Uranium Finance incident, more than four years following the original attacks.


