TL;DR:
- A Manhattan federal jury convicted Jonathan Spalletta of computer fraud and money laundering for draining $53.3 million from Uranium Finance in April 2021.
- Prosecutors proved that $26 million was routed through the privacy mixer Tornado Cash between April 2021 and November 2023 to purchase rare Pokémon and Magic: The Gathering collectible cards, as well as historical artifacts.
- Federal authorities seized nearly $31 million in digital assets in February 2025 alongside exclusive physical collectibles, while the sentencing date remains pending.
Jonathan Spalletta, a cybersecurity consultant, was found guilty by a New York federal jury on charges of crypto hacking and money laundering linked to the breach of the Uranium Finance platform in April 2021.
The verdict followed brief deliberations that began last Tuesday in a Manhattan federal court. According to reporting by Inner City Press, jurors found the defendant guilty on both counts brought by federal prosecutors.
Court filings show the attacker drained approximately $53.3 million in digital assets from the BNB Chain-based automated market maker. Legal documentation specifies that the exploit stemmed from a mathematical flaw in version 2.1 of the protocol’s smart contracts, where a missing zero in a balance validation check allowed the perpetrator to drain 26 liquidity pools.
Weeks prior to the final exploit, the protocol suffered an earlier breach on April 8, 2021, involving $1.4 million. According to case records, Spalletta returned roughly $1 million framed as a purported bug bounty reward before executing the full-scale drain on April 28 of that year.
The financial investigation revealed a systematic scheme designed to conceal the origin of the stolen on-chain funds.
The Tornado Cash Trail and Collectibles Purchases
Prosecution filings establish that the defendant channeled approximately $26 million through privacy mixer Tornado Cash between April 2021 and November 2023. On-chain investigator ZachXBT tracked fractional transfers of 100 ETH that were subsequently converted into fiat currency for private acquisitions.
Part of those funds financed high-value collectible trading cards and historical relics on the secondary market.
The acquisition inventory entered into the case record includes a Magic: The Gathering Black Lotus card purchased for $500,000 and a first-edition Pokémon base set valued at $750,000. The defendant also purchased sealed Alpha Booster boxes for $1.51 million, a sealed Pokémon booster box for $257,500, an ancient Roman coin commemorating the assassination of Julius Caesar for $601,545, and fabric fragments from the Wright brothers’ airplane for $137,500.
Throughout the trial, the defense argued a lack of direct attribution regarding the identity of the person behind the keyboard. Prosecutors countered using on-chain tracking and personal communications in which the defendant acknowledged exploiting smart contract vulnerabilities.
Under federal statutory sentencing guidelines, the offenses carry maximum penalties of up to 10 years in prison for computer fraud and 20 years for money laundering. The court noted that these statutory ceilings serve as upper limits, with the final sentence subject to the discretion of U.S. District Judge Jed S. Rakoff.
In February 2025, the U.S. government executed the seizure of approximately $31 million in cryptocurrencies linked to the exploit, alongside the confiscated physical items. The federal court has not yet scheduled a formal date for the sentencing hearing or established a timeline for final asset restitution orders.
