Jury convicts Uranium Finance hacker who spent crypto loot on Pokemon cards

What happened

A Manhattan federal jury found Jonathan Spalletta guilty of computer fraud and money laundering in the 2021 Uranium Finance case, according to Inner City Press. Deliberations started Tuesday afternoon and the verdict came Wednesday. Judge Jed S. Rakoff denied a prosecution request for GPS monitoring, pointing to Spalletta's court attendance.

Prosecutors said the first attack took place on April 8, 2021. Spalletta used Uranium's smart contract to pull out more rewards than he should have received, taking about $1.4 million. He kept about $386,000 as a sham bug bounty after giving back the rest.

The second attack came on April 28, 2021. A withdrawal calculation error let Spalletta drain about $53.3 million across several liquidity pools, and Uranium shut down because it lacked funds. Prosecutors said the flaw affected 26 liquidity pools.

Spalletta moved the money through Tornado Cash and then bought collectibles, including Magic: The Gathering and Pokémon cards. His purchases included a Black Lotus card for about $500,000, 18 sealed Alpha Booster packs for about $1.5 million, a first edition Pokémon base set for about $750,000, and a sealed first edition booster box for about $257,500. He also bought a Roman Eid Mar coin for about $601,545 and Wright brothers airplane fabric for about $137,500.

Federal authorities seized about $31 million in cryptocurrency in February 2025. They also seized collectibles, including the Black Lotus card and the Wright brothers fabric, from his home.

U.S. Attorney Jamie McDonald said the crimes cost people more than $50 million and caused an entire crypto platform to collapse. Prosecutors asked anyone who thinks they were a victim to contact Homeland Security Investigations.

Why it matters

The verdict links a major DeFi exploit to a criminal conviction. About $26 million moved through Tornado Cash between April 2021 and November 2023, and blockchain investigator ZachXBT traced millions leaving the mixer in 100 ETH chunks.

Sentencing has not been set. The charges carry statutory maximums of 10 years for computer fraud and 20 years for money laundering, but those are ceilings, not a forecast of what Judge Rakoff will impose.

The case may affect how courts view privacy tools and smart contract bugs. The defense argued that prosecutors could not prove whose fingers were on the keyboard and that Tornado Cash was a privacy tool.

Background

• Uranium Finance was a BNB Chain decentralized finance automated market maker. It was hit twice in April 2021.
• Spalletta, 36, of Rockville, Maryland, was charged over the exploits in March.
• Uranium lacked funds after the second attack and shut down.

What is still unclear

• Sentencing has not been set, so the punishment is unknown.
• The seized crypto was worth about $31 million at the time of seizure in February 2025, but the reports do not give its current value.
• The reports do not state whether Spalletta will appeal after the verdict.

Questions readers ask