Uranium Finance Hacker Arrested! Stole 54 Million in Cryptocurrency, Up to 30 Years in Prison

Maryland resident Jonathan Spalletta turned himself in to authorities on March 31, facing charges filed by the U.S. Attorney’s Office for the Southern District of New York (SDNY) over two hacking attacks he carried out in 2021 against the BNB Chain DeFi protocol Uranium Finance. The attacks caused more than $54 million in cryptocurrency losses and led to the platform being shut down.

Two Attacks in a Month: Struck Twice, Then the Platform Collapsed

Uranium Finance is a forked automated market maker (AMM) protocol on BNB Chain based on Uniswap, launched during the April bull market of 2021. The indictment shows that Spalletta carried out two precise attacks in less than a month:

First Attack (April 8): The platform had been live for only a few days. Spalletta used a vulnerability in smart contracts to extract cryptocurrency rewards far beyond what he was authorized to receive, stealing about $1.4 million. Afterward, Uranium Finance reached a private agreement with the hacker, recovering all of the stolen funds except $386,000.

Second Attack (April 28): The scale was dramatically upgraded. Spalletta exploited a critical contract flaw that affected withdrawal limits across 26 independent liquidity pools, stealing approximately $53.3 million in crypto assets, including Bitcoin (BTC), Ethereum (ETH), and the platform’s native token. After the second attack, the Uranium Finance website shut down, and victims have not received any compensation to date.

The Bizarre Fate of the Stolen Funds: Crypto Converted Into Historical Artifacts and Trading Cards

The indictment reveals the most unexpected uses of the stolen funds. During a search of Spalletta’s residence, law enforcement found the following items:

Pokémon Cards: A collection of rare cards purchased with stolen cryptocurrency

Ancient Roman coins: Physical ancient currency from the Roman Empire period

Lighter Brothers aircraft fabric: Rare historical artifact fragments taken from the original Lighter Brothers aircraft

In February 2025, authorities had previously seized approximately $31 million in cryptocurrency related to this case, but at the time, no details were made public. The publication of this indictment is what fully discloses the investigation results regarding the flow of funds.

Legal Charges: Computer Fraud and Money Laundering, Up to 30 Years in Prison

Spalletta faces two federal criminal charges: computer fraud, punishable by up to 10 years, and money laundering, punishable by up to 20 years; the two charges combined carry a maximum prison term of up to 30 years. He appeared before a U.S. district judge, Judge Ona Wang, to formally hear the indictment.

U.S. prosecutor Jay Clayton emphasized in a statement: “Stealing from a cryptocurrency exchange is theft, and the claim that ‘cryptocurrency is different’ cannot change that fact. Spalletta caused tens of millions of dollars in losses to real victims, and now he has been arrested.”

2021 was a particularly active year for DeFi hacking attacks, with total losses exceeding $2.6 billion for the year; the largest single incident was a $610 million event targeting the cross-chain protocol Poly Network (the attacker later voluntarily returned the funds). The special aspect of the Uranium Finance case is that victims still have not received any compensation to date.

Frequently Asked Questions

Why could Uranium Finance’s second hacking attack cause such massive losses?

The second attack exploited a logical vulnerability in Uranium’s smart contracts that controlled withdrawal limits for 26 independent liquidity pools. Through a single precise operation, the attacker bypassed the withdrawal limits of all pools, draining the vast majority of the protocol’s assets at once. The scale reached approximately $53.3 million, causing the platform to lose all liquidity and be forced to shut down permanently.

Why can buying Pokémon cards and ancient Roman coins be considered money laundering?

The legal elements of money laundering include disposing of proceeds of crime in any manner, making them appear to have a legitimate source or be difficult to trace. Converting stolen cryptocurrency into physical collectibles is a classic form of “layered” money laundering—turning digital assets into physical form, concealing the source of funds while preserving the value of the assets—which fits the legal definition of money laundering.

Can Uranium Finance victims receive compensation from this indictment?

Authorities seized approximately $31 million in cryptocurrency related to this case in February 2025. If there is a conviction, the court could issue an order for asset forfeiture and require compensation for victims. However, whether funds can be recovered and how much ultimately depends on the progress of the subsequent judicial proceedings. Victims currently face a high degree of uncertainty.