A Maryland man has been charged with carrying out hacks in 2021 that drained more than $50 million from decentralized exchange Uranium Finance and forced the platform to shut down, the US Justice Department said Monday.
Jonathan Spalletta, 36, of Rockville, Maryland, faces one count of computer fraud and one count of money laundering, according to an indictment unsealed by the Southern District of New York. The charges follow a seizure of approximately $31 million in crypto in February 2025 linked to the exploit, and link a year-old DeFi case to a named defendant for the first time.
The attack on Uranium Finance drained key pools linked to BNB, BUSD and other assets and left Uranium unable to continue operations.
Prosecutors allege that Spalletta first exploited Uranium’s bounty mechanism on April 8, 2021, draining about $1.4 million before later negotiating what authorities describe as a bogus “bug bounty” that allowed him to keep about $386,000.
He later wrote to a colleague: “I did a crypto theft … Crypto is all fake internet money anyway,” according to the indictment.
Authorities allege Spalletta laundered the proceeds through a series of transactions, including the use of the crypto mixer Tornado Cash, before spending the funds on high-end collectibles.
Those purchases, according to the indictment, included a Black Lotus Magic: The Gathering card worth about $500,000, 18 sealed Alpha booster packs worth about $1.5 million, first edition Pokémon sets worth more than $1 million and a Roman “Eid Mar” coin commemorating the assassination of Julius Caesar for about $0001.
Spalletta surrendered on Monday and is expected to appear before a US judge in Manhattan.
