A U.S. jury convicted Jonathan Spalletta, known online as Jspalletta and Cthulhon, of stealing more than $53 million from the decentralized Uranium Finance platform after hacking it twice in April 2021. Spalletta faces up to 10 years in prison for computer fraud and 20 years for money laundering.
Two Separate Smart-Contract Exploits
Uranium Finance was an automated market maker operating on the BNB Chain. In the first attack, on April 8, 2021, Spalletta exploited a flaw in the smart-contract code that allowed him to issue withdrawal orders for zero tokens, forcing the platform to pay rewards that were not owed. This resulted in the withdrawal of approximately $1.4 million from the liquidity pool.
He then extorted the platform for approximately $386,000 under the guise of a fake bug bounty, in exchange for returning the rest of the stolen funds.
Three weeks later, he exploited a separate software error in the transaction-validation logic. The system used the value 1,000 instead of 10,000, allowing him to withdraw nearly 90% of the assets held in the liquidity pools while depositing almost nothing in return. He obtained approximately $53.3 million in total, most of the platform's holdings, forcing it to shut down immediately because of insufficient liquidity.
Tracing the Funds and Recovering Some of Them
Spalletta routed the stolen cryptocurrency through the Tornado Cash mixer and several decentralized exchanges. In December 2023, cryptocurrency fraud investigator ZachXBT linked more than 11,200 ETH withdrawn from Tornado Cash, worth $25 million at the time, to the hacker.
The money was spent on high-value collectibles, including 18 sealed packs of Magic Alpha Booster cards worth approximately $1.5 million, a first-edition Base Set Pokémon collection worth about $750,000, a Black Lotus card from Magic: The Gathering worth approximately $500,000, and an ancient Roman coin commemorating the assassination of Julius Caesar worth more than $601,000.
Authorities seized these collectibles from Spalletta's home in February 2025 and also recovered approximately $31 million in cryptocurrency from wallets linked to him.
Why Does This Matter?
The case shows that a limited error in smart-contract logic, such as using an incorrect numerical denominator, can turn into an almost total loss of a decentralized financial platform's assets. It also shows that concealing the flow of funds through mixers and decentralized platforms does not necessarily prevent investigators from linking transactions to a suspect's identity, although the ruling does not change the fact that recovering funds depends on what can actually be identified and seized.
U.S. Attorney Jamie McDonald said the crime caused real losses to victims and led to the collapse of the cryptocurrency platform, rejecting the idea that digital assets should be dismissed as “fake internet money.”