A federal jury in New York has convicted Jonathan Spalletta, 36, of Maryland, for stealing $53.3 million from decentralized crypto exchange Uranium Finance in April 2021 before laundering the proceeds into rare collectibles. Following a trial that concluded with approximately two hours of jury deliberation, Spalletta now faces up to 30 years in prison for his actions.
Exploiting Uranium Finance Smart Contracts
According to court filings from the U.S. Department of Justice, Spalletta first uncovered a vulnerability in Uranium Finance smart contracts on April 8, 2021, using it repeatedly to collect about $1.4 million in unauthorized funds. Two weeks after the initial incident, Spalletta described the exploit in writing, stating: "I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway."
Prosecutors revealed that Spalletta subsequently coerced Uranium Finance into letting him retain $386,000 under the guise of a sham "bug bounty." Shortly after, on April 28, 2021, Spalletta executed a second attack targeting another flaw in the protocol, draining $53.3 million across multiple liquidity pools and forcing Uranium Finance to shut down permanently. Smart contract vulnerabilities remain a persistent threat across decentralized protocols, prompting institutional efforts such as risk ratings for the $10 billion crypto vault market.
Laundering Stolen Millions into Pokémon Cards and Artifacts
To conceal the origins of the stolen funds, Spalletta routed the assets through privacy mixer Tornado Cash. He then purchased several rare physical items, including:
- A first-edition Pokémon base set valued at approximately $750,000
- A sealed Pokémon booster box for $257,500
- A rare Magic: The Gathering Black Lotus card for $500,000
- An ancient Roman coin commemorating the assassination of Julius Caesar for $601,545
- A scrap of Wright brothers airplane fabric carried to the moon by astronaut Neil Armstrong for $137,500
Federal agents seized the Black Lotus card, the historic moon fabric, and approximately $31 million in cryptocurrency from Spalletta's home. U.S. Attorney Jamie McDonald stated: "As Spalletta’s many victims know, those words could not be further from the truth."
Key Takeaways
- Jonathan Spalletta, 36, was convicted by a New York jury after two hours of deliberation and faces up to 30 years in prison.
- The April 2021 exploits against Uranium Finance netted $53.3 million, forcing the protocol to shut down.
- Federal law enforcement seized $31 million in crypto alongside rare collectibles like a $500,000 Black Lotus card and a $137,500 piece of Neil Armstrong moon fabric.
Why It Matters
This conviction establishes a clear judicial precedent rejecting the "code is law" defense frequently cited by decentralized finance exploiters. By classifying the deliberate manipulation of smart contract bugs as criminal theft rather than permissible arbitrage, federal prosecutors have signaled that off-chain legal systems will strictly enforce accountability on-chain.
Furthermore, the federal seizure of $31 million in digital assets and high-value physical collectibles demonstrates the increasing sophistication of law enforcement in tracing mixer-routed funds and recovering physical assets to provide restitution to victims.
