Uranium Finance attacker found guilty in $53 million crypto heist
A Maryland man was convicted of stealing more than $53 million by hacking the Uranium Finance crypto exchange twice in April 2021. He exploited smart contract bugs, forced the exchange to pay a sham bug bounty, and later moved funds through Tornado Cash and decentralized exchanges. Investigators seized collectible cards and coins and recovered roughly $31 million in cryptocurrency.
Jonathan Spalletta, 36, who also used the names "Jspalletta" and "Cthulhon," surrendered on March 30 and was charged with computer fraud and money laundering. In April 2021 he attacked Uranium Finance, an automated market maker on BNB Chain, twice. The first breach drained about $1.4 million through a smart-contract flaw, and he then pressured the exchange into paying roughly $386,000 as a fake bug-bounty payment.
A second coding error let him withdraw nearly 90% of liquidity-pool assets while depositing almost nothing, netting about $53.3 million and shutting Uranium down. He laundered funds via Tornado Cash and decentralized exchanges, bought rare cards and coins, and investigators later seized collectibles and recovered about $31 million in crypto.
The conviction may strengthen deterrence for crypto attackers by showing that on-chain tracing and seizures can follow stolen funds into collectibles and wallets. It could also affect DeFi users and exchanges, who may face continued pressure to audit smart contracts and monitor mixers. Because recovered funds covered only part of losses, victims and the shuttered platform may still feel lasting financial harm. Regulators and investigators could use the case as a template, though outcomes may vary.