A Manhattan federal jury convicted Maryland cybersecurity consultant Jonathan Spalletta on October 7, 2026, of computer fraud and money laundering for two 2021 exploits that drained more than $53 million from the decentralized exchange Uranium Finance. Jurors reached the verdict after roughly two hours of deliberation, according to Bloomberg.

Spalletta, who used the online aliases "Cthulhon" and "Jspalletta," exploited smart-contract flaws across two attacks separated by 20 days. The first, on April 8, 2021, yielded about $1.4 million through a manipulation of the platform's reward mechanism. The second, on April 28, 2021, was more severe by an order of magnitude: he pulled approximately $53.3 million by exploiting weaknesses spread across 26 of Uranium Finance's liquidity pools.

The April 28 attack forced the exchange to cease operations and triggered a multi-year federal investigation.

Where did the stolen funds go?

Prosecutors say Spalletta laundered roughly $26 million of the proceeds through Tornado Cash, a cryptocurrency mixing service, between 2021 and 2023. The remainder funded a luxury shopping spree in rare collectibles.

Court filings link Spalletta to a Black Lotus Magic: The Gathering card valued near $500,000, first-edition Pokémon sets worth more than $1 million combined, and a Roman "Eid Mar" coin priced at approximately $601,500. The seized collectibles exceeded $3 million in value.

In February 2025, federal authorities seized approximately $31 million in cryptocurrency from Spalletta.

How did the case reach trial?

Federal prosecutors charged Spalletta in March 2026, and he surrendered the same day. He pleaded not guilty. The trial opened September 28, 2026, and closed with the October 7 conviction on one count of computer fraud and one count of money laundering. Sentencing is scheduled for February 16, 2027.

The statutory maximum totals 30 years: as many as 10 years on the fraud count and 20 years on the money laundering count.

What does the verdict signal for DeFi?

The conviction underscores that pseudonymous on-chain activity does not preclude identification. Investigators used blockchain forensics to follow the funds across Tornado Cash and into the collectibles market, producing a jury verdict within two hours of deliberation.

Recovery remains incomplete. With about $31 million seized against more than $53 million taken, the gap illustrates the limits of post-exploit remediation for DeFi victims.

The February 16, 2027 sentencing will set a benchmark for how U.S. federal courts treat large-scale decentralized finance theft and the use of mixers for laundering.