A Manhattan federal jury convicted cybersecurity consultant Jonathan Spalletta on October 7, 2026 of computer fraud and money laundering, closing a case that began with the April 2021 collapse of decentralized exchange Uranium Finance. The jury deliberated for roughly two hours after a six-day trial before US District Judge Jed S. Rakoff.

The verdict holds Spalletta accountable for two exploits that drained Uranium Finance of approximately $54.7 million combined and forced the protocol to shut down permanently. Prosecutors presented evidence of smart-contract attacks, laundering through Tornado Cash, and the conversion of stolen funds into rare collectibles.

What did the attacks target?

The first exploit came on April 8, 2021. Spalletta abused a smart-contract function that tracked rewards, extracting about $1.4 million from the protocol.

The second attack, on April 28, 2021, did far more damage. It drained approximately $53.3 million across 26 liquidity pools. Uranium Finance shut down after the attacks and never reopened.

Spalletta operated under the online handles "Cthulhon" and "Jspalletta." The case was tried in the US District Court for the Southern District of New York.

How were the proceeds laundered?

Between 2021 and 2023, Spalletta moved roughly $26 million through Tornado Cash, the crypto mixing service designed to obscure the origin and destination of funds on-chain.

He also converted stolen crypto into high-end physical collectibles, including:

• A Black Lotus card from Magic: The Gathering
• A Roman coin marking the assassination of Julius Caesar
• A fragment of fabric from a Wright brothers airplane that had been flown to the moon

On February 24, 2025, law enforcement seized approximately $31 million in crypto linked to the theft. Authorities also recovered collectibles from Spalletta's residence valued at more than $3 million.

What does the ruling change?

Prosecutors argued that operating in crypto offers no legal shield for exploiting a platform, and that conventional fraud and theft statutes apply fully to smart-contract attacks. The jury agreed, and did so quickly.

The outcome reinforces that the "code is law" position carries no weight in a US courtroom when prosecutors can tie an exploit to an identifiable actor. For DeFi builders, the operational lesson is in the attack vector itself: the first Uranium Finance exploit targeted a rewards-tracking function, the kind of unglamorous infrastructure code that often receives less audit scrutiny than headline features. That is precisely where a determined attacker went looking.

The timeline matters as much as the verdict. The exploits occurred in April 2021, the seizure came in February 2025, and the conviction arrived in October 2026. For affected users, enforcement punished the attacker years after the collapse, but it could not rebuild the protocol. Recovered funds arrived only through seizure, long after liquidity was destroyed.

What happens next?

Spalletta faces a potential total of 30 years in prison. The computer fraud count carries a statutory maximum of 10 years, and the money laundering count carries a maximum of 20 years. Statutory maximums are ceilings rather than predictions.

Sentencing is scheduled for February 16, 2027, before Judge Rakoff, who will determine the final term.