Federal prosecutors have charged Jonathan Spalletta, 36, of Maryland with computer fraud and money laundering for exploiting smart contract bugs in Uranium Finance, a decentralized exchange on Binance Smart Chain, in two separate attacks during April 2021. The combined theft totaled roughly $54 million. Authorities seized about $31 million in cryptocurrency tied to the case in February 2025.
A decentralized exchange is a cryptocurrency trading platform that runs on self-executing code called smart contracts instead of a central company holding user funds.
Key takeaways
- Jonathan Spalletta faces up to 30 years in prison for draining roughly $54 million from Uranium Finance in two April 2021 exploits.
- U.S. investigators seized about $31 million in cryptocurrency linked to the attacks in a February 2025 operation.
- Spalletta allegedly laundered stolen tokens through Tornado Cash and spent proceeds on a Black Lotus Magic card, first-edition Pokemon sets, rare Roman coins, and a Wright brothers artifact carried to the moon.
- The case is the first time a defendant has been publicly identified in the years-old DeFi exploit, filed in the Southern District of New York.
Published: March 31, 2026 12:00 UTC
How the two exploits worked
Spalletta first targeted Uranium Finance on or about April 8, 2021, according to the federal indictment. Prosecutors say he found a flaw in the platform’s reward distribution logic that let him withdraw far more tokens than the contract should have allowed. That attack drained a liquidity pool of nearly all its tokens and netted roughly $1.4 million.
Weeks later, on April 28, he exploited a separate arithmetic error in the smart contract code that miscalculated token balances across 26 liquidity pools. This second breach extracted approximately $53 million and forced the platform to shut down permanently because its reserves were gone.
In messages reviewed by investigators, Spalletta described his actions as “a crypto heist” and told another person that “crypto is just fake internet money anyway,” according to the Department of Justice.
From crypto to collectibles
Rather than keeping the stolen funds on-chain, prosecutors allege Spalletta converted the tokens to ether, routed them through Tornado Cash (the cryptocurrency mixing service), and then cashed out through exchanges and dealers. The DOJ’s indictment details an unusual spending spree on high-value physical collectibles.
Among the purchases: a Black Lotus Magic: The Gathering card worth roughly $500,000, 18 sealed Alpha booster packs valued at about $1.5 million, first-edition Pokemon card sets exceeding $1 million, a rare Roman “Eid Mar” coin purchased for more than $601,500, and a piece of fabric from the Wright brothers’ airplane that was later carried to the moon during the Apollo 11 mission.
The FBI traced these acquisitions as part of a broader effort to recover stolen DeFi funds. The February 2025 seizure of approximately $31 million in cryptocurrency marked the first public link between a named defendant and the long-unsolved Uranium Finance case.
What the charges mean for DeFi enforcement
Spalletta faces one count of computer fraud carrying a maximum sentence of 10 years and one count of money laundering carrying up to 20 years. The case was filed in the Southern District of New York, the federal court that has handled many of the largest crypto prosecutions including those against FTX founder Sam Bankman-Fried.
The indictment signals that the DOJ is still actively pursuing older DeFi exploits even years after the funds were stolen. For protocols built on automated smart contracts, the case is a reminder that exploiting code vulnerabilities still carries the same criminal liability as any other form of theft.
Uranium Finance, which operated as a fork of Uniswap on Binance Smart Chain, never recovered from the second attack. Its shutdown left liquidity providers with total losses and no mechanism for restitution. Whether the seized $31 million will eventually be returned to victims has not been addressed publicly by prosecutors.
Frequently asked questions
What was Uranium Finance?
Uranium Finance was a decentralized exchange on Binance Smart Chain that allowed users to trade tokens and earn fees by depositing funds into liquidity pools. It was a fork of Uniswap. The platform shut down permanently after its second exploit in April 2021 drained all remaining funds.
How much cryptocurrency was recovered from the hack?
U.S. investigators seized approximately $31 million in cryptocurrency in a February 2025 operation. The original theft totaled roughly $54 million across two attacks, meaning a significant portion of the stolen funds remains unrecovered or was spent on physical goods.
Why did it take five years to charge someone?
The attacker used Tornado Cash, a cryptocurrency mixing service, to obscure transaction trails. Tracing laundered crypto funds through mixers requires specialized blockchain forensics and often takes years. The February 2025 asset seizure appears to have provided the breakthrough linking Spalletta to the exploits.
