Maryland man Jonathan Spalletta found guilty over two 2021 hacks of crypto exchange Uranium Finance that took about US$53.3 million and forced it to shut down
BleepingComputer reported on 8 October 2026 that Jonathan Spalletta, 36, of Maryland (online 'Jspalletta' and 'Cthulhon'), has been found guilty of computer fraud and money laundering over the April 2021 hacks of Uranium Finance, an automated market maker on BNB Chain. In the first attack on 8 April 2021 he drained about US$1.4 million by abusing a smart-contract flaw with zero-token withdrawals, then pressured Uranium into a sham 'bug bounty' of nearly US$386,000. About three weeks later he exploited a second coding error, where transaction checks used 1,000 instead of 10,000, to withdraw nearly 90% of the liquidity pools, about US$53.3 million in total, and Uranium closed. Prosecutors say he laundered the funds through Tornado Cash and decentralised exchanges and bought rare collectibles, including Magic: The Gathering packs and a Black Lotus card, a first-edition Pokémon base set and a Roman coin. Agents seized the collectibles in February 2025 and recovered about US$31 million in crypto. He surrendered on 30 March and faces up to 10 years for computer fraud and 20 years for money laundering. Source: BleepingComputer, quoting the US Attorney's office.
- Product
- Uranium Finance (BNB Chain automated market maker, shut down 2021)
- Versions
- n/a
- Exploited in Australia?
- unknown
- Patch to
- No action needed. Context for DeFi teams: both thefts came from arithmetic and logic errors in contract code, so independent audits and invariant checks on withdrawal maths matter more than perimeter controls.
Primary: BleepingComputer — Uranium crypto exchange hacker convicted for stealing $53 million (8 Oct 2026)