A brazen cyberheist on a decentralized crypto exchange, Uranium Finance, has come to an end with the conviction of 36-year-old Jonathan Spalletta. The Maryland man was found guilty of stealing over $53 million in cryptocurrency after hacking the exchange not once, but twice in April 2021.
Spalletta’s modus operandi involved exploiting vulnerabilities in Uranium’s smart contract code to drain its liquidity pools and extort the company into returning some of the stolen funds. In his first breach, he exploited a flaw that allowed him to issue zero-token withdrawal commands, forcing the exchange to pay out nearly $1.4 million in rewards he wasn’t entitled to. He then extorted Uranium into assigning a “bug bounty” of nearly $386,000 from the stolen funds to retrieve the rest.
Three weeks later, Spalletta struck again, this time exploiting a separate coding error that allowed him to withdraw nearly 90% of the assets held in Uranium’s liquidity pools. This netted him about $53.3 million and forced the exchange to shut down immediately. The stolen cryptocurrency was then laundered through the Tornado Cash mixer and multiple decentralized exchanges.
Spalletta’s spending spree with the ill-gotten gains is a telling indicator of his callous disregard for the victims he caused harm to. He splurged on luxury items, including 18 sealed packs of Alpha Booster Magic cards worth around $1.5 million, a first-edition complete Pokémon base set for roughly $750,000, and an ancient Roman coin commemorating Julius Caesar’s assassination for over $601,000.
Fortunately, law enforcement agents were able to recover some of the stolen funds, seizing luxury items from Spalletta’s residence in February 2025 and recovering around $31 million in cryptocurrency from crypto wallets linked to him. The conviction serves as a warning to would-be hackers that cybercrime will not go unpunished.
The case highlights the risks associated with decentralized finance (DeFi) platforms and the importance of robust security measures to prevent such breaches. Uranium’s collapse due to Spalletta’s actions is a stark reminder of the vulnerabilities in these systems and the need for greater vigilance.
As the U.S. Attorney Jamie McDonald noted, “Spalletta’s crimes cost real people to lose real money—over $50 million dollars—and caused an entire crypto platform to collapse.” The conviction carries a maximum sentence of 10 years in prison for computer fraud and up to 20 years for money laundering. This serves as a warning to others who would seek to exploit the vulnerabilities in our digital systems.
In light of this case, it’s essential for individuals and organizations to prioritize cybersecurity and take proactive measures to protect against such attacks. Regularly updating software, implementing robust security protocols, and educating oneself on potential risks are crucial steps towards safeguarding against cybercrime.
Source: Bleeping Computer — 2026-10-08