A Manhattan federal jury on Wednesday convicted Jonathan Spalletta of computer fraud and money laundering tied to two 2021 smart-contract exploits that drained more than $50 million from decentralized exchange Uranium Finance and forced the platform to shut down.

Spalletta, 36, of Rockville, Maryland, was found guilty on all counts after a six-day trial before U.S. District Judge Jed S. Rakoff in the Southern District of New York. He faces a statutory maximum of 10 years for computer fraud and 20 years for money laundering. Sentencing has not been scheduled.

How the two exploits worked

The first attack occurred on April 8, 2021. Spalletta repeatedly invoked Uranium's staking contract to withdraw far more rewards than his deposits entitled him to, netting roughly $1.4 million. He then pressured the project into letting him keep about $386,000 as what prosecutors called a sham "bug bounty" in exchange for returning the remainder.

Two weeks later, on April 28, 2021, Spalletta exploited a separate arithmetic error in how the same smart contract calculated withdrawals across multiple liquidity pools, extracting approximately $53.3 million in a single transaction. The drain left Uranium without the funds needed to honor user balances, and the platform ceased operations.

In a message sent shortly after the first exploit, Spalletta wrote to another party: "I did a crypto heist of $1.5MM a couple of weeks ago... There was a bug in a smart contract, and I exploited it... Crypto is all fake internet money anyway." Prosecutors introduced the message at trial to establish intent.

What the laundering trail looked like

Spalletta moved the proceeds through a layered series of transfers, including through sanctioned coin mixer Tornado Cash, before converting portions into fiat to fund high-end collectible purchases. According to the indictment and trial evidence:

• Magic: The Gathering. A Black Lotus card for about $500,000 and 18 sealed Alpha Booster packs for roughly $1.5 million.
• Pokémon. A first-edition complete base set for about $750,000 and a sealed box of first-edition booster packs for about $257,500.
• Numismatics. An Eid Mar denarius, a Roman silver coin commemorating the assassination of Julius Caesar, for about $601,545.
• Memorabilia. A piece of fabric from the Wright brothers' original airplane that Neil Armstrong carried to the moon, for about $137,500.

Investigators seized the Black Lotus, the Wright brothers' fabric fragment and several of the coins from his residence under a search warrant.

What the jury saw in U.S. Attorney statements

U.S. Attorney for the Southern District of New York Jamie McDonald framed the verdict in terms of retail investor losses. "Spalletta's crimes cost real people to lose real money—over $50 million dollars—and caused an entire crypto platform to collapse," McDonald said.

The SDNY's Office added: "Our prosecutors of the Office and our agency partners have done outstanding work to ensure Spalletta's virtual world criminal conduct ended in his real-world criminal conviction." Homeland Security Investigations and the FBI handled the financial tracing; the FBI New York Field Office led the broader investigation.

What gets recovered next

Authorities seized cryptocurrency traceable to the Uranium hacks worth about $31 million at the time of seizure in February 2025, the office said. Prosecutors have asked anyone who believes they were a victim of the 2021 exploits to contact HSI, signaling that a restitution process will run alongside sentencing.

The case adds a politically significant data point to the post-Tornado Cash enforcement landscape: proceeds routed through a mixer sanctioned by Treasury in 2022 were still recoverable on-chain, and an overseas smart-contract exploit followed by domestic luxury spending proved sufficient to secure a full criminal conviction. Spalletta's sentencing hearing will determine how those facts translate into prison time and a final forfeiture order.