Uranium Finance hacker Jonathan Spalletta convicted for $50M theft; spent stolen funds on collectibles including Pokémon cards, Magic cards, and rare artifacts.
Security & Exploits ·
A Manhattan jury has convicted Jonathan Spalletta on computer fraud and money laundering charges stemming from two 2021 exploits of the decentralized exchange Uranium Finance. The 36-year-old from Rockville, Maryland, stole more than $50 million across the attacks—first extracting roughly $1.4 million in April through repeated transactions with the platform's smart contract, then seizing approximately $53.3 million two weeks later by exploiting a calculation error in withdrawal logic. The second breach caused Uranium to cease operations due to insufficient funds. Spalletta faces up to 10 years for computer fraud and 20 years for money laundering.
Rather than retain the stolen cryptocurrency, Spalletta laundered proceeds through Tornado Cash and spent the funds on collectible assets. His purchases included a Black Lotus Magic: The Gathering card for roughly $500,000, sealed Alpha Booster packs valued near $1.5 million, a complete first-edition Pokémon base set for about $750,000, and a sealed first-edition booster box for approximately $257,500. He also acquired an Eid Mar denarius—a Roman coin commemorating Julius Caesar's assassination—for roughly $601,545 and a piece of Wright brothers aircraft fabric, moon-flown by Neil Armstrong, for about $137,500.
Authorities recovered the Black Lotus card, fabric, certain coins, and cryptocurrency holdings worth approximately $31 million in February 2025 from a search of his residence. The investigation remains open to victims of the Uranium hacks, whom prosecutors have asked to file reports with Homeland Security Investigations.