A Maryland man has been charged with leading the 2021 hacks that drained more than $50 million from decentralized exchange Uranium Finance and forced the platform to shut down, the U.S. Department of Justice announced Monday.
Jonathan Spalletta, 36, of Rockville, Maryland, faces one count of computer fraud and one count of money laundering, according to an indictment unsealed by the Southern District of New York. The charges follow a February 2025 seizure of approximately $31 million in crypto linked to the exploit, linking a years-old DeFi case to a named defendant for the first time.
The attack on Uranium Finance emptied key pools linked to BNB, BUSD and other assets and left Uranium unable to continue operating.
Prosecutors say Spalletta first exploited Uranium’s reward scheme on April 8, 2021, draining approximately $1.4 million before later trading what authorities describe as a fake “bug bounty” that allowed him to keep approximately $386,000.
He then wrote to an associate: “I committed a crypto heist…Crypto is just fake money on the internet anyway,” according to the indictment.
Authorities say Spalletta laundered the funds through a series of transactions, including using crypto mixer Tornado Cash, before spending the funds on high-end collectibles.
Those purchases, according to the indictment, included a Black Lotus Magic: The Gathering card for approximately $500,000, 18 sealed Alpha booster packs for approximately $1.5 million, first edition Pokémon sets worth more than $1 million, and an “Eid Mar” Roman coin commemorating the assassination of Julius Caesar for approximately $601,500.
Spalletta turned himself in Monday and is expected to appear before a U.S. magistrate judge in Manhattan.
