Uranium Finance Hacker Who Bought Pokémon and Magic Cards Convicted Over $50M Theft
Jonathan Spalletta also spent stolen crypto on a Roman coin marking Julius Caesar's assassination and moon-flown Wright brothers fabric.
A Manhattan jury has convicted Jonathan Spalletta of computer fraud and money laundering over two 2021 hacks of decentralized crypto exchange Uranium Finance, federal prosecutors said Wednesday.
Spalletta, 36, of Rockville, Maryland, was charged over the exploits in March. He was convicted on all counts after a six-day trial before U.S. District Judge Jed S. Rakoff, and faces a maximum of 10 years in prison for computer fraud and 20 years for money laundering.
Jonathan Spalletta convicted for defrauding crypto exchange of over $50 million in hacks: "Our prosecutors of the Office and our agency partners have done outstanding work to ensure Spaletta’s virtual world criminal conduct ended in his real-world criminal conviction," said USA…
In the first hack, on April 8, 2021, Spalletta repeated a series of transactions with Uranium's smart contract to withdraw far more rewards than he was entitled to, taking about $1.4 million.
He then pressured Uranium into letting him keep about $386,000 as what prosecutors called a sham "bug bounty" in exchange for returning the rest.
Two weeks after that hack, he wrote to another person: "I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway."
On April 28, 2021, he exploited an error in how the contract calculated withdrawals across several liquidity pools , taking about $53.3 million and causing Uranium to shut down for lack of funds.
"Spalletta's crimes cost real people to lose real money, over $50 million dollars, and caused an entire crypto platform to collapse," said U.S. Attorney Jamie McDonald.
Spalletta laundered the funds through a series of transactions, including through coin mixer Tornado Cash, then spent them on collectibles including Magic: The Gathering and Pokémon cards.
His Magic: The Gathering purchases included a Black Lotus card for about $500,000 and 18 sealed packs of Alpha Booster cards for about $1.5 million. For Pokémon, he paid about $750,000 for a first edition complete base set and about $257,500 for a sealed box of first edition booster packs.
He also bought an Eid Mar denarius, a Roman coin commemorating the assassination of Julius Caesar, for about $601,545, and a piece of fabric from the Wright brothers' original airplane that Neil Armstrong carried to the moon, for about $137,500.
The Black Lotus, the fabric and some of the coins were seized from his home under a search warrant. In February 2025, authorities also seized cryptocurrency from the Uranium hacks worth about $31 million at the time.
Prosecutors have asked anyone who believes they were a victim of the Uranium hacks to contact Homeland Security Investigations .
