Jonathan Spalletta Convicted For Defrauding Crypto Exchange Of Over $50 Million In Hacks

United States Attorney for the Southern District of New York, Jamie McDonald, announced the conviction by jury of JONATHAN SPALLETTA, a/k/a "Cthulhon," a/k/a "Jspalletta," for computer fraud and money laundering in connection with his hacks of the decentralized cryptocurrency exchange Uranium Finance ("Uranium"). SPALLETTA was convicted on all counts of the Indictment following a six day jury trial before U.S. District Judge Jed S. Rakoff.

"As a unanimous Manhattan jury has found, Jonathan Spalletta repeatedly exploited vulnerabilities in the code of a decentralized cryptocurrency platform to steal tens of millions of dollars," said U.S. Attorney Jamie McDonald. "Spalletta's own words are indicative of his dangerously misguided indifference for his victims and the hardships he caused, saying: 'Crypto is just fake internet money anyway.' As Spalletta's many victims know, those words could not be further from the truth. Spalletta's crimes cost real people to lose real money-over $50 million dollars-and caused an entire crypto platform to collapse. Our prosecutors of the Office and our agency partners have done outstanding work to ensure Spaletta's virtual world criminal conduct ended in his real-world criminal conviction."

According to the Indictment, public filings, and evidence presented at trial:

Uranium was a decentralized cryptocurrency exchange that allowed users to deposit and exchange different kinds of cryptocurrencies via liquidity pools. In April 2021, SPALLETTA committed two separate hacks of Uranium.

In the first hack, on April 8, 2021, SPALLETTA engaged in a deceptive series of transactions with Uranium's smart contract that SPALLETTA used to withdraw far more "rewards" in cryptocurrency than he was authorized to receive. He repeated those transactions over and over until he had drained the liquidity pool of nearly all its rewards tokens. In total, SPALLETTA successfully extracted cryptocurrency worth approximately $1.4 million in the first hack. Approximately two weeks after he fraudulently obtained the funds, SPALLETTA told another individual in writing, "I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway." SPALLETTA subsequently extorted Uranium into agreeing to allow him to keep approximately $386,000 of the money he stole as a sham "bug bounty" to help him evade prosecution in exchange for return of the remainder of the stolen money to Uranium.

In the second hack, on April 28, 2021, SPALLETTA exploited an error in the Uranium smart contract that governed how much cryptocurrency he could withdraw in a liquidity pool on Uranium. SPALLETTA exploited that issue across multiple separate Uranium liquidity pools, fraudulently obtaining approximately $53.3 million in cryptocurrency and causing Uranium to shut down due to lack of funds.

SPALLETTA then laundered the funds he had fraudulently obtained from Uranium through a complex series of cryptocurrency transactions, including by using the cryptocurrency mixer Tornado Cash.

After laundering the funds, SPALLETTA used the money he had fraudulently obtained to purchase personal collectable items, including but not limited to (i) rare cards for the trading card game Magic: The Gathering ("Magic Cards"); (ii) rare cards for the trading card game Pokémon (the "Pokémon Cards"); and (iii) antique Roman coins (the "Antique Coins"), among other items. In particular, SPALLETTA used the fraudulently obtained funds to purchase: (i) a "Black Lotus" Magic Card for approximately $500,000; (ii) 18 packs of sealed "Alpha Booster" Magic Cards for approximately $1,512,500; (iii) one sealed box of first edition "Booster" Pokémon Cards for approximately $257,500; (iv) one first edition complete base set of Pokémon Cards for approximately $750,000; (v) a piece of fabric from the original Wright brothers' airplane that was subsequently transported to the surface of the moon by astronaut Neil Armstrong on the first moon landing, for approximately $137,500; (vi) one "Eid Mar Denarius," an Antique Coin commemorating the assassination of Julius Caesar, for approximately $601,545.

Photographs of the Black Lotus Magic Card, the piece of fabric from the original Wright brothers' airplane that was subsequently transported to the surface of the moon by astronaut Neil Armstrong, and certain of the Antique Coins, all of which were seized from the residence of SPALLETTA pursuant to a judicially-authorized search warrant, are below.

In addition, on February 24, 2025, law enforcement seized pursuant to a judicially-authorized seizure warrant cryptocurrency worth approximately $31 million at the time of seizure that SPALLETTA had fraudulently obtained from Uranium.

If you believe you have been a victim of the Uranium hack, please contact [email protected].

* * *

SPALLETTA, 36, of Rockville, Maryland, was convicted of one count of computer fraud, which carries a maximum sentence of 10 years in prison; and one count of money laundering, which carries a maximum sentence of 20 years in prison.

The maximum potential sentences in this case are prescribed by Congress and provided here for informational purposes only, as any sentencing of the defendant will be determined by a judge.

Mr. McDonald praised the outstanding work of HSI.

The case is being prosecuted by the Office's Complex Frauds and Cybercrime Unit. Assistant U.S. Attorneys Kevin Mead, William C. Kinder, and Shaun Werblow are in charge of the prosecution.