A Manhattan jury has convicted Jonathan Spalletta, 36, of Rockville, Maryland, on charges of computer fraud and money laundering related to two 2021 hacks of the decentralized exchange Uranium Finance. Following a six-day trial before U.S. District Judge Jed S. Rakoff, Spalletta faces maximum penalties of 10 years for computer fraud and 20 years for money laundering. The conviction stems from an April 8, 2021 exploit where he manipulated smart contract transactions to withdraw approximately $1.4 million, subsequently retaining about $386,000 under a sham bug bounty agreement. Two weeks later, on April 28, 2021, he exploited a calculation error in liquidity pool withdrawals to steal roughly $53.3 million, causing the platform to collapse due to insufficient funds.
Prosecutors detailed that Spalletta laundered the stolen assets through Tornado Cash and other transactions, spending the proceeds on high-value collectibles including Magic: The Gathering and Pokémon cards. Specific purchases included a Black Lotus card for about $500,000, sealed Alpha Booster packs for $1.5 million, and a first edition Pokémon base set for $750,000. He also acquired a Roman denarius for $601,545 and Wright Brothers airplane fabric for $137,500. Authorities seized physical items from his home and recovered cryptocurrency worth approximately $31 million at the time of seizure in February 2025. U.S. Attorney Jamie McDonald stated the crimes caused real financial losses exceeding $50 million and led to the failure of the crypto platform.
The conviction of Jonathan Spalletta underscores the increasing efficacy of law enforcement in tracing illicit cryptocurrency flows through privacy tools like Tornado Cash. By successfully linking digital theft to physical asset purchases, authorities demonstrated that blockchain anonymity is not absolute when forensic accounting intersects with traditional investigative methods. This case highlights the vulnerability of decentralized exchanges to smart contract exploits and the subsequent lack of recourse for users when platforms collapse without insurance or regulatory safeguards. The judicial outcome serves as a deterrent signal to actors who assume that exploiting code vulnerabilities constitutes a victimless crime or remains beyond the reach of federal prosecution.
From a market structure perspective, this ruling reinforces the necessity for robust security audits and transparent incident response protocols within the DeFi sector. The ability of prosecutors to seize significant portions of the stolen value, both in physical collectibles and remaining cryptocurrency, suggests that asset recovery mechanisms are maturing alongside criminal sophistication. However, the total loss suffered by victims exceeds the recovered amount, indicating persistent gaps in consumer protection frameworks. Future regulatory developments may focus on mandating clearer liability standards for protocol developers and enhancing cooperation between crypto-native entities and traditional financial intelligence units to mitigate operational risks associated with unsecured smart contracts.
