Hacker Convicted for Stealing $53 Million from Uranium Finance Crypto Exchange

Hacker Convicted for Multi-Million Dollar Crypto Theft

Jonathan Spalletta, 36, from Maryland, has been found guilty of computer fraud and money laundering. The conviction stems from two separate hacks of the decentralized crypto exchange Uranium Finance in April 2021, which resulted in the theft of over $53 million in cryptocurrency.

Exploiting Smart Contract Vulnerabilities

Spalletta's first attack on April 8, 2021, involved exploiting a flaw in Uranium's smart contract code. He issued zero-token withdrawal commands, forcing the exchange to pay unentitled rewards and draining approximately $1.4 million from its liquidity pool. He then extorted the exchange for a nearly $386,000 'bug bounty' from the stolen funds.

Three weeks later, Spalletta executed a second attack by exploiting a different coding error. This flaw caused the exchange's transaction-verification logic to use an incorrect multiplier (1,000 instead of 10,000), allowing him to withdraw nearly 90% of Uranium's assets while depositing effectively zero tokens. This second breach netted him about $53.3 million and forced the immediate shutdown of Uranium Finance.

Money Laundering and Asset Recovery

After acquiring the cryptocurrency, Spalletta laundered the stolen funds using the Tornado Cash cryptocurrency mixer and various decentralized exchanges. He subsequently used the proceeds to purchase high-value collectibles, including rare Magic: The Gathering cards, a first-edition Pokémon base set, and an ancient Roman coin, totaling over $3 million.

Law enforcement agents seized these collectibles from Spalletta's residence in February 2025. Additionally, approximately $31 million in cryptocurrency was recovered from wallets linked to him. Crypto fraud investigator ZachXBT initially linked over 11,200 ETH withdrawn from Tornado Cash to the Uranium hacker in December 2023.