\n
![](\"https:\/\/media.crypto.news\/2025\/11\/crypto-news-Fragmented-liquidity-hack-crime-option06.webp\")
<\/p>\n
\n<\/p>\n
A New York jury has convicted cybersecurity consultant Jonathan Spalletta of computer fraud and money laundering over two Uranium Finance attacks that drained nearly $55 million, with the money laundering count carrying up to 20 years in prison.<\/p>\n
\n Summary<\/span>\n <\/p>\n <\/p>\n The U.S. Attorney\u2019s Office for the Southern District of New York announced<\/a> on Oct. 7 that Spalletta, 36, of Rockville, Maryland, had been found guilty on every count in his indictment following a trial before U.S. District Judge Jed Rakoff.<\/p>\n According to Bloomberg, jurors deliberated for more than two hours before returning their verdict, and Rakoff scheduled sentencing for Feb. 16. The report said defense lawyers had argued that Spalletta used publicly available smart contract functions rather than forged credentials or malicious code.<\/p>\n In its statement, the U.S. Attorney\u2019s Office said the computer fraud count carries a maximum prison term of 10 years, while the money laundering count carries a maximum of 20 years. The office stressed that Congress sets those limits and that a judge will determine the actual sentence.<\/p>\n Earlier in the case, crypto.news reported on March 31 that federal authorities had charged the Maryland resident<\/a> over the two attacks. The report identified computer fraud and money laundering as the charges and described the losses as exceeding $54 million.<\/p>\n <\/p>\n At the indictment stage, the Justice Department said Spalletta surrendered on March 30 and was due to appear before U.S. Magistrate Judge Ona T. Wang. Prosecutors identified him by the online aliases \u201cCthulhon\u201d and \u201cJspalletta,\u201d and assigned the case to the office\u2019s Complex Frauds and Cybercrime Unit.<\/p>\n In announcing the verdict, U.S. Attorney Jamie McDonald said a unanimous Manhattan jury had found that Spalletta repeatedly used weaknesses in the platform\u2019s code to take users\u2019 cryptocurrency. The office said its account of the attacks drew on the indictment, public filings and evidence presented during the trial.<\/p>\n According to prosecutors, Uranium Finance allowed users to deposit and exchange cryptocurrencies through liquidity pools. Spalletta\u2019s first attack, on April 8, 2021, targeted a smart contract that paid cryptocurrency rewards.<\/p>\n By repeating a series of transactions, prosecutors said, he withdrew far more rewards than he was entitled to receive and drained nearly all the reward tokens from the affected pool. The office valued the cryptocurrency taken in that attack at approximately $1.4 million.<\/p>\n In a written message sent about two weeks later, Spalletta described his actions to another person, according to the prosecution:<\/p>\n \u201cI did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway.\u201d<\/p>\n<\/blockquote>\n After that theft, the office said, Spalletta pressured Uranium into accepting an arrangement under which he kept about $386,000 and returned the remaining funds. Prosecutors described the retained payment as a sham \u201cbug bounty\u201d intended to help him avoid prosecution.<\/p>\n For the second attack, on April 28, prosecutors said he exploited an error in the contract governing withdrawals from liquidity pools. The original charging announcement identified 26 affected pools and put the stolen cryptocurrency at about $53.3 million, while the conviction announcement said the loss forced Uranium to shut down.<\/p>\n In April 2021, reporting on the platform\u2019s $50 million breach<\/a> cited Uranium\u2019s announcement that the incident occurred during its migration to version 2.1. The same report said the project was working with Binance\u2019s security team and had asked users to report the stolen funds through their Binance accounts.<\/p>\n Following the attacks, the U.S. Attorney\u2019s Office said Spalletta moved the stolen assets through a series of cryptocurrency transactions, including the mixing service Tornado Cash, before spending part of the proceeds on collectibles.<\/p>\n Separate reporting in January 2024 documented a 2.5 million BUSD transfer<\/a> from an address labeled as the Uranium exploiter. Citing PeckShield, the report said the funds moved from BNB Chain to Ethereum through Li.fi, with the receiving address obtaining 812 ETH and about $505,500 in stablecoins.<\/p>\n Among Spalletta\u2019s purchases, prosecutors listed a Black Lotus Magic: The Gathering card costing about $500,000 and 18 sealed Alpha Booster packs costing approximately $1,512,500. The office also identified a sealed box of first-edition Pok\u00e9mon booster packs bought for about $257,500 and a complete first-edition Pok\u00e9mon base set costing approximately $750,000.<\/p>\n Beyond trading cards, prosecutors said he paid about $601,545 for an Eid Mar Denarius, an ancient Roman coin commemorating Julius Caesar\u2019s assassination. Another purchase, according to the office, was a $137,500 piece of fabric from the Wright brothers\u2019 original airplane that Neil Armstrong later carried to the moon.<\/p>\n Under a court-authorized search warrant, investigators seized the Black Lotus card, the aircraft fabric and ancient coins from Spalletta\u2019s residence, the Justice Department said. Bloomberg reported that rare Pok\u00e9mon and Magic: The Gathering cards seized from the Maryland home were worth more than $3 million.<\/p>\n Separately, the U.S. Attorney\u2019s Office said law enforcement seized cryptocurrency linked to the Uranium thefts on Feb. 24, 2025. Those assets were worth approximately $31 million at the time of seizure.<\/p>\n For affected users, the office\u2019s Oct. 7 announcement directs anyone who believes they were a victim of the Uranium hack to contact Homeland Security Investigations at [email\u00a0protected]<\/a>.<\/p>\n <\/p><\/div>\n\n\n
Uranium Finance convictions carry separate prison limits<\/h2>\n
Two April attacks drained rewards and trading pools<\/h2>\n
\n
Prosecutors traced laundering and multimillion-dollar card purchases<\/h2>\n
U.S. investigators seized assets and provided a victim contact<\/h2>\n