A Maryland man has been found guilty of stealing over $53 million from a decentralized cryptocurrency exchange, forcing it to shut down due to lack of funds. Jonathan Spalletta, also known online as “Jspalletta” and “Cthulhon,” was convicted of computer fraud and money laundering after hacking Uranium Finance twice in April 2021.
Spalletta’s heists were made possible by exploiting flaws in the exchange’s smart contract code, which allowed him to drain nearly $53.3 million from its liquidity pools. The first breach occurred on April 8, when Spalletta exploited a coding error that enabled him to issue zero-token withdrawal commands, forcing Uranium to pay out rewards he wasn’t entitled to. He then extorted the exchange into assigning a sham “bug bounty” of nearly $386,000 from the stolen funds.
Three weeks later, Spalletta struck again, this time exploiting another coding error in the transaction-verification logic that allowed him to withdraw nearly 90% of the assets held in Uranium’s liquidity pools. This netted Spalletta a staggering $53.3 million and forced Uranium to shut down immediately. The stolen cryptocurrency was then laundered through the Tornado Cash mixer and multiple decentralized exchanges, with proceeds spent on luxury collectibles such as rare Magic cards and an ancient Roman coin.
The investigation into Spalletta’s crimes began in December 2023, when crypto fraud investigator ZachXBT linked over 11,200 ETH withdrawn from Tornado Cash to the Uranium hacker. Law enforcement agents eventually seized these collectibles from Spalletta’s residence in February 2025 and recovered roughly $31 million in cryptocurrency from wallets linked to him.
The conviction of Jonathan Spalletta serves as a stark reminder of the devastating consequences of cybercrime. As U.S. Attorney Jamie McDonald noted, “Spalletta’s own words are indicative of his dangerously misguided indifference for his victims and the hardships he caused.” With the global cryptocurrency market continuing to grow, it’s essential for exchanges and investors alike to prioritize security measures and protect against similar attacks.
For individuals looking to safeguard their digital assets, this case highlights the importance of vigilance and awareness. By staying informed about emerging threats and best practices in cybersecurity, we can all play a role in preventing such heists from occurring in the future.
Source: Bleeping Computer — 2026-10-08