A cybersecurity consultant from Rockville, Maryland, went on trial September 28 in Manhattan federal court on charges he hacked the decentralized finance platform Uranium Finance in April 2021 and stole approximately $54.7 million in cryptocurrency across two attacks.

Jonathan Spalletta, 36, faces one count of computer fraud, which carries up to 10 years in prison, and one count of money laundering, with a maximum sentence of 20 years. He surrendered to authorities, and the indictment was unsealed on March 30, 2026.

Two intrusions, 26 pools

The prosecution's case rests on two distinct intrusions. The first, on April 8, 2021, drained roughly $1.4 million from Uranium Finance. The second landed on April 28, 2021: prosecutors allege Spalletta exploited vulnerabilities across 26 separate liquidity pools and siphoned $53.3 million in a single attack.

The platform, which operated on the Binance Smart Chain, did not survive. Uranium Finance shut down after the second exploit, its liquidity effectively wiped out.

In opening statements, prosecutors argued that whatever the underlying technological complexity, the conduct amounted to ordinary theft. The digital wrapping, they told the jury, does not change what happened.

The defense is expected to take a different line. Attorneys for Spalletta do not dispute that the hacks occurred, according to the case framing, but plan to contest whether the government can place their client's hands on the keyboard for either attack. The question for the jury is attribution, not the existence of the exploits.

Tornado Cash and collectibles

Prosecutors say Spalletta laundered the stolen funds through Tornado Cash, the mixing protocol that obscures transaction trails by pooling deposits from multiple users before returning them to fresh addresses.

He also spent. Authorities flagged a Black Lotus card from Magic: The Gathering valued at roughly $500,000 and a Roman "Eid Mar" coin worth more than $601,500 — a denarius commemorating the assassination of Julius Caesar in 44 BC. Combined with other collectibles, prosecutors put the physical purchases at more than $1 million.

Investigators traced enough of the money to build a case. In February 2025, authorities seized approximately $31 million in cryptocurrency from Spalletta.

Why the trial matters

The case is notable less for the size of the alleged theft than for the fact that it reached a courtroom at all. DeFi exploits have historically resisted prosecution because pseudonymous blockchain transactions obscure attacker identities. Mixers such as Tornado Cash were long treated as a near-definitive break in the investigative chain.

The February 2025 seizure suggests otherwise. Federal investigators, working with blockchain forensics tools, followed the money more than three years after the exploit and through a mixer — and recovered a majority of the stolen funds. For enforcement agencies, that capability changes the calculus around DeFi crime, which has often been written off as unrecoverable.

The prosecution's framing carries legal weight as well. By arguing that stealing from a DeFi protocol is simply theft, prosecutors are positioning existing computer fraud and money laundering statutes as fully sufficient to cover digital asset crime, without requiring new legislation tailored to decentralized protocols.

The trial continues in Manhattan federal court. Spalletta has not entered a guilty plea, and the verdict will hinge on whether the government can convince the jury that its blockchain forensics tell a complete and accurate story linking the defendant to the April 2021 attacks.