Federal prosecutors charged Jonathan Spalletta, 36, of Rockville, Maryland, with computer fraud and money laundering over a 2021 hack that drained more than $50 million from Uranium Finance. The U.S. Department of Justice announced the charges Monday, following a significant seizure of cryptocurrency tied to the exploit. This case represents the first time a named defendant has been publicly linked to the years-old decentralized finance incident.
The indictment unsealed by the Southern District of New York alleges Spalletta exploited smart contract bugs on April 8, 2021, to drain key pools tied to BNB, BUSD, and other assets. Prosecutors state the attack forced the decentralized exchange to shut down permanently after the exploit emptied its liquidity. Authorities estimate the total loss exceeded $50 million before the platform ceased operations. The charges follow a February 2025 seizure of approximately $31 million in crypto tied to the exploit.
Investigation Details
Spalletta allegedly exploited Uranium’s rewards mechanism, laundering the proceeds through complex crypto transactions including the use of Tornado Cash. He later wrote to an associate, admitting to the heist and dismissing the value of digital currency. This strategy allowed him to maintain anonymity while spending millions on rare items before surrendering to authorities. A key detail in the filing notes a sham bug bounty negotiation that permitted him to retain approximately $386,000 initially.
Investigators allege the defendant spent millions of dollars on high-end collectibles rather than converting the crypto to fiat currency. These purchases reportedly included a Black Lotus Magic: The Gathering card and first-edition Pokémon sets worth over $1 million. Funds were also used to acquire an ancient Roman coin commemorating the assassination of Julius Caesar for about $601,500. Additional spending covered 18 sealed Alpha booster packs valued at roughly $1.5 million.
The suspect surrendered on Monday and is expected to appear before a U.S. magistrate judge in Manhattan. He faces one count of computer fraud and one count of money laundering under federal law. Prosecutors have not yet disclosed specific bail terms or detention status pending the initial court appearance. This legal action concludes a long investigation into the movement of illicit digital assets across multiple jurisdictions.
According to the indictment, Spalletta communicated his actions to a confidant before the arrest. The message explicitly stated his view on the nature of the stolen funds. "I did a crypto heist … Crypto is all fake internet money anyway," Spalletta reportedly wrote to an associate, according to the indictment.
Industry Implications
This case highlights ongoing vulnerabilities within decentralized finance protocols and the rewards mechanisms used by early platforms. Security audits remain a critical barrier against exploits that drain user liquidity pools. The industry continues to grapple with the balance between innovation and asset protection for users. Developers must now consider how reward structures can be weaponized against the protocol itself.
Enforcement actions like this signal a shift toward holding individuals accountable for historical blockchain crimes. Future investigations may focus more on tracing funds through non-fungible tokens and physical collectibles. Regulators expect these precedents to influence compliance standards for digital asset custodians. Law enforcement agencies are increasingly collaborating with blockchain analytics firms to identify illicit flows.
