The U.S. Department of Justice has announced it is prosecuting Jonathan Spalletta of Maryland for his alleged involvement in the 2021 cyberattack that saw over $50 million in cryptocurrency stolen from the decentralized exchange Uranium Finance. The 36-year-old, who resides in Rockville, faces charges of computer fraud and money laundering in connection with the high-profile exploit that shook the decentralized finance (DeFi) sector three years ago.
Details of the Uranium Finance breach
According to the investigation, Spalletta allegedly targeted vulnerabilities in Uranium Finance’s reward system, transferring digital assets worth roughly $1.4 million to his account in an initial move on April 8, 2021. It is further alleged that, after the incident, he sought to conceal the exploit by negotiating a fraudulent “bug bounty” arrangement. As part of this ruse, he was purportedly permitted to retain cryptocurrencies valued at $386,000.
Experts explained that following the breach, core liquidity pools for assets such as BNB and BUSD were rapidly drained, leaving the platform with irretrievable losses. The scale of the theft ultimately led to the permanent closure of Uranium Finance. In February 2025, authorities reportedly seized approximately $31 million in crypto assets linked to the incident, highlighting ongoing efforts to recover stolen funds. Notably, this marks the first time since the original attack that a prosecution has been launched in relation to a major DeFi hack.
How the stolen crypto was spent
The official indictment details how Spalletta allegedly laundered the proceeds of the theft through intricate transactions, including utilization of the crypto-mixing service Tornado Cash. These illicit gains were then converted into high-value collectibles. Among the acquisitions were a Black Lotus Magic: The Gathering card estimated at $500,000, sealed Alpha booster packs worth approximately $1.5 million, first-edition Pokémon sets exceeding $1 million in total, and the rare “Eid Mar” Roman coin symbolizing Julius Caesar’s assassination—believed to have cost around $601,500.
Prosecutors revealed that Spalletta boasted in a private message after the attack, writing, “I pulled off a crypto heist… Crypto is just fake internet money anyway.”
The complaint asserts that Spalletta took numerous steps to obscure the origin of the funds, channeling the illegal money into luxury purchases that included collectible cards and rare coins.
Spalletta is reported to have surrendered to authorities and will soon appear before a U.S. judge in Manhattan to face the charges.
The prosecution draws fresh attention to the enduring vulnerabilities within DeFi protocols and the lengths to which individuals may go to exploit and launder proceeds from such attacks. Industry observers note that the case is emblematic of broader regulatory and security challenges facing decentralized finance projects since their rapid growth in recent years.
In addition to recovering significant digital assets, authorities continue to underscore the importance of robust defense mechanisms and legal deterrents to protect investors and platforms in the evolving crypto landscape. The outcome of this prosecution may set new legal precedents for future DeFi-related cases.
While Uranium Finance has remained offline since the incident, investigations and asset recovery efforts have persisted, culminating in the current legal proceedings and asset seizures both in the U.S. and internationally.
