Cybersecurity Consultant Convicted in $54 Million Uranium Finance Hack
A US federal jury convicted Maryland cybersecurity consultant Jonathan Spalletta for stealing over $54 million from cryptocurrency exchange Uranium Finance through two sophisticated smart contract exploits.
A U.S. federal jury has convicted Maryland cybersecurity consultant Jonathan Spalletta of computer fraud and money laundering for orchestrating the theft of more than $54 million from the cryptocurrency exchange Uranium Finance. The conviction stems from two separate attacks carried out in April 2021, which exploited vulnerabilities in the exchange's smart contracts.
Spalletta, acting as a cybersecurity consultant, leveraged his expertise to manipulate the exchange's smart contracts—self-executing programs that govern cryptocurrency transactions—to illicitly withdraw funds. The first attack netted approximately $1.4 million, while a subsequent, more significant exploit in the second attack siphoned off $53.3 million. The scale of these thefts ultimately forced Uranium Finance to cease operations.
Following the exploits, Spalletta employed sophisticated methods to obscure the trail of the stolen cryptocurrency. He utilized multiple transactions, including transfers through Tornado Cash, a privacy-focused mixer service designed to anonymize digital asset movements. This complex layering of transactions aimed to make tracing the funds exceedingly difficult for authorities.
The illicit proceeds were not solely held in cryptocurrency; Spalletta reportedly spent a portion of the stolen funds on luxury and collectible items. These included rare Pokémon and Magic: The Gathering cards, antique Roman coins, and even a piece of the Wright brothers' airplane, highlighting an unusual and extravagant dissipation of the stolen wealth.
Law enforcement efforts led to the seizure of a substantial amount of the stolen cryptocurrency in February 2025. Authorities successfully recovered $31 million in digital assets, representing a significant portion of the funds that had been laundered and hidden.
Prosecutors have indicated that Spalletta faces severe penalties for his crimes. He could receive a maximum prison sentence of 10 years for the computer fraud charges and an additional 20 years for the money laundering convictions, reflecting the gravity of the financial cybercrime.
In parallel developments, a federal court in Florida ordered a $30 million penalty in the Fundsz fraud case, involving misleading investors about digital asset and precious metals schemes. The report also notes the halting of services by Near Intents after a $3.8 million hack, the impending shutdown of Abstract Blockchain, and victim reimbursements from Velocity following a $295 million hack.