Uranium Finance Hacker Who Bought Pokémon and Magic Cards Convicted Over $50M Theft

A Manhattan jury has convicted Jonathan Spalletta of laptop fraud and cash laundering over two 2021 hacks of decentralized crypto exchange Uranium Finance, federal prosecutors said Wednesday.

Spalletta, 36, of Rockville, Maryland, was charged over the exploits in March. He was convicted on all counts after a six-day trial earlier than U.S. District Decide Jed S. Rakoff, and faces a most of 10 years in jail for laptop fraud and 20 years for cash laundering.

Within the first hack, on April 8, 2021, Spalletta repeated a collection of transactions with Uranium’s smart contract to withdraw way more rewards than he was entitled to, taking about $1.4 million.

He then pressured Uranium into letting him preserve about $386,000 as what prosecutors referred to as a sham “bug bounty” in trade for returning the remaining.

Two weeks after that hack, he wrote to a different individual: “I did a crypto heist of $1.5MM a few weeks in the past . . . There was a bug in a wise contract, and I exploited it . . . Crypto is all faux web cash anyway.”

On April 28, 2021, he exploited an error in how the contract calculated withdrawals throughout a number of liquidity pools, taking about $53.3 million and inflicting Uranium to close down for lack of funds.

“Spalletta’s crimes price actual individuals to lose actual cash—over $50 million {dollars}—and brought about a complete crypto platform to break down,” stated U.S. Lawyer Jamie McDonald.

Black Lotus and Roman cash

Spalletta laundered the funds by means of a collection of transactions, together with by means of coin mixer Twister Money, then spent them on collectibles together with Magic: The Gathering and Pokémon playing cards.

His Magic: The Gathering purchases included a Black Lotus card for about $500,000 and 18 sealed packs of Alpha Booster playing cards for about $1.5 million. For Pokémon, he paid about $750,000 for a primary version full base set and about $257,500 for a sealed field of first version booster packs.

He additionally purchased an Eid Mar denarius, a Roman coin commemorating the assassination of Julius Caesar, for about $601,545, and a bit of cloth from the Wright brothers’ authentic airplane that Neil Armstrong carried to the moon, for about $137,500.

The Black Lotus, the material and among the cash have been seized from his residence underneath a search warrant. In February 2025, authorities additionally seized cryptocurrency from the Uranium hacks price about $31 million on the time.

Prosecutors have requested anybody who believes they have been a sufferer of the Uranium hacks to contact Homeland Security Investigations.