Maryland Man Found Guilty of Hacking Uranium Finance Twice and Stealing $53 Million in Cryptocurrency
A Maryland man was found guilty of hacking the decentralized cryptocurrency exchange Uranium Finance twice and stealing more than $53 million in digital assets.
Jonathan Spalletta, 36, who also used the online aliases “Jaspaletta” and “Cthulhon,” turned himself in to police on March 30 and was charged with computer fraud and money laundering.
According to court documents, Spalletta targeted Uranium Finance, an automated market maker operating on Binance’s BNB Chain. His attacks drained approximately $53.3 million in cryptocurrency and forced the platform to shut down because it lacked sufficient funds.
First Uranium Finance attack exploited a smart contract flaw
Spalletta’s first attack took place on April 8, 2021. He exploited a flaw in Uranium Finance’s smart contract code to issue zero-token withdrawal commands and force the exchange to pay him compensation to which he was not entitled.
The attack drained approximately $1.4 million from Uranium’s liquidity pool. Spalletta then forced the exchange to allocate a fake “bug bounty” worth approximately $386,000 from the stolen funds in an attempt to recover the remainder.
Second exploit drained nearly 90% of the exchange’s assets
Three weeks later, Spalletta attacked Uranium Finance again. This time, he exploited a coding error in the exchange’s trade-validation logic. The system used 1,000 instead of 10,000, allowing him to withdraw nearly 90% of the assets held in Uranium’s liquidity pool while depositing virtually no tokens.
The second attack netted approximately $53.3 million, representing the majority of Uranium Finance’s holdings, and forced the cryptocurrency exchange to shut down immediately.
Spalletta then laundered the stolen cryptocurrency through the Tornado Cash mixer and multiple decentralized exchanges.
Stolen cryptocurrency used to buy rare collectibles
According to prosecutors, Spalletta used the proceeds to purchase 18 sealed packs of Alpha Booster Magic cards for approximately $1.5 million, a first-edition complete Pokémon core set for approximately $750,000, “Black Lotus” Magic: The Gathering cards for approximately $500,000, and an ancient Roman coin commemorating the assassination of Julius Caesar for more than $601,000.
Law enforcement seized the collectibles from his residence in February 2025. Investigators also recovered approximately $31 million in virtual currency from wallets linked to Spalletta.
Crypto fraud investigator ZachXBT also identified links involving more than 11,200 ETH withdrawn from Tornado Cash, worth approximately $25 million at the time, and transferred to the Uranium Finance hacker in December 2023. ZachXBT’s analysis tracked the movement of the funds.
Prosecutors say the cryptocurrency theft caused real-world losses
“Spalletta’s own words demonstrate his dangerously misguided indifference to his victims and the suffering he has caused, stating that ‘cryptocurrency is just fake internet money anyway,’” said U.S. Attorney Jamie McDonald, according to a statement from the U.S. Attorney’s Office.
“As many of Spalletta’s victims know, those words could not be further from the truth. Spalletta’s crimes caused real people to lose over $50 million in real money and entire crypto platforms to collapse.”
Spalletta faces up to 10 years in prison for computer fraud and up to 20 years in prison for money laundering.
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.
Source: www.bleepingcomputer.com