Twenty days separated the two raids on Uranium Finance in April 2021, and the second one emptied the exchange. A federal jury in Manhattan has now convicted Jonathan Spalletta, 36, of Rockville, Maryland, on every count against him, after a six-day trial before U.S. District Judge Jed S. Rakoff. The U.S. Attorney’s Office for the Southern District of New York announced the verdict on October 7.
Prosecutors say Spalletta took about $53.3 million from Uranium Finance in that second hack on April 28, 2021, and spent part of the proceeds on rare Magic: The Gathering and Pokémon cards. The exchange, a decentralized platform that ran on liquidity pools of customer crypto, shut down for lack of funds.
The case answers a question that anyone holding crypto on an exchange or in a pool-based platform eventually faces: what happens to the money when the code underneath it has a flaw. Customers of a decentralized exchange do not have a bank behind the balance, and Uranium’s depositors learned that a single coding error could drain the pools they had put money into.
Spalletta has not been sentenced and no sentencing date has been announced, so the penalty that follows this verdict is still the next thing to watch.
Get the next update the morning it lands →
Two hacks 20 days apart
The first hack came on April 8, 2021. Prosecutors say Spalletta made a series of deceptive transactions with Uranium’s smart contract to withdraw far more in rewards than he was entitled to, and repeated them until the rewards pool was nearly empty. That netted about $1.4 million.
He then pressured Uranium into letting him keep about $386,000 as a sham “bug bounty” in exchange for returning the rest, according to SDNY. In writing to another person, the release says, he described the episode this way: “Crypto is all fake internet money anyway.”
The second hack was far larger. Spalletta exploited an error in the contract that limited how much could be withdrawn from a liquidity pool and drained multiple pools of about $53.3 million. Charging documents put that at 26 pools, and BleepingComputer reported that the flaw was a single-character coding error. Across both hacks, the total was roughly $54.7 million, the same sum The Block reported when the charges were filed in March 2026, with a headline noting that he faced up to 30 years, the two maximum terms added together.
What the money bought
Prosecutors say Spalletta moved the proceeds through a complex series of crypto transactions, including the Tornado Cash mixer, then used them to buy collectibles. Tornado Cash is an Ethereum mixer that the Treasury Department says has been used to launder more than $7 billion in virtual currency since it was created in 2019, in a 2022 release announcing sanctions on the mixer, and prosecutors say Spalletta ran the stolen funds through it before buying cards. SDNY listed these approximate prices:
- A “Black Lotus” Magic: The Gathering card, about $500,000
- 18 sealed Alpha booster packs of Magic cards, about $1,512,500
- A sealed box of first-edition Pokémon booster cards, about $257,500
- A first-edition complete Pokémon base set, about $750,000
- A piece of fabric from the Wright brothers’ airplane that was later carried to the Moon by Neil Armstrong, about $137,500
- A Roman “Eid Mar” denarius coin commemorating the assassination of Julius Caesar, about $601,545
Those six items add up to roughly $3.76 million, a small share of the haul. The release says other items were bought too, and agents seized some from his home under a search warrant.
What was recovered and what comes next
Law enforcement seized cryptocurrency worth about $31 million on February 24, 2025, under a judicial seizure warrant, and SDNY says it came from the Uranium funds. That is a little more than half of the roughly $54.7 million taken.
The jury convicted Spalletta of one count of computer fraud, which carries a maximum of 10 years in prison, and one count of money laundering, which carries a maximum of 20. SDNY notes that Congress sets those maximums and that a judge will decide the actual sentence.
U.S. Attorney Jamie McDonald said Spalletta’s own words show a “dangerously misguided indifference for his victims,” and that his crimes “caused an entire crypto platform to collapse.” The case was handled by the office’s Complex Frauds and Cybercrime Unit, and McDonald credited Homeland Security Investigations for its work on the investigation.
Weighing exchange risk after the Uranium verdict
Federal prosecutors describe how the theft worked in the original charging announcement, including the dates, the pools and the seizure. Anyone who believes they were affected by the Uranium hack can write to UraniumVictims@hsi.dhs.gov, the address Homeland Security Investigations gave in the release.
For people holding crypto on any platform, the useful comparison is who controls the funds. A decentralized exchange pools customer deposits in code that no company guarantees, so a flaw in that code is a loss to depositors.
Recovery was partial here. About $31 million was seized from roughly $54.7 million taken, and how much goes back to Uranium’s depositors has not been announced. Sentencing, and any order on restitution that comes with it, are the next steps in the SDNY case.
More Financial Reading
- 24 Ways to Stretch a $2,087 Social Security Check
- 17 Places to Find Your Share of the $4.25 Billion States Give Back
- 17 Ways Retirees Are Tapping a Record $14.9 Trillion in Home Equity
This article was produced with AI assistance and reviewed by The Financial Wire’s editorial team.
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
