Key points

  • A Manhattan federal jury convicted Jonathan Spalletta on computer-fraud and money-laundering counts after a six-day trial.
  • Prosecutors said two April 2021 attacks extracted about $1.4 million and $53.3 million from Uranium Finance.
  • Spalletta has not yet been sentenced; the statutory maximums are 10 years for computer fraud and 20 years for money laundering.

A Manhattan federal jury has convicted Jonathan Spalletta of computer fraud and money laundering for two attacks that drained approximately $54.7 million in cryptocurrency from Uranium Finance in 2021. The U.S. Attorney's Office for the Southern District of New York said jurors found Spalletta guilty on every count after a six-day trial before U.S. District Judge Jed S. Rakoff.

The verdict changes the case

The conviction replaces the allegations contained in the March indictment with a jury finding of guilt. Spalletta, 36, of Rockville, Maryland, has not yet been sentenced. The Justice Department said the computer-fraud count carries a maximum term of 10 years and the money-laundering count carries a maximum of 20 years. Those figures are statutory limits, not a forecast of the sentence the judge will impose.

Related reporting: US charges Vietnamese national in alleged $16M crypto scam

Two attacks, three weeks apart

According to evidence described by prosecutors, the first attack occurred on April 8, 2021. Spalletta repeatedly used Uranium's smart contract to withdraw more reward tokens than he was authorized to receive, extracting about $1.4 million. Prosecutors said he later pressured the platform into letting him retain roughly $386,000 as a purported bug bounty in exchange for returning the balance. On April 28, he exploited a separate error governing liquidity-pool withdrawals and obtained approximately $53.3 million. Uranium subsequently shut down because it lacked funds.

Funds moved through Tornado Cash

The Justice Department said Spalletta routed stolen assets through a complex series of transactions that included the Tornado Cash cryptocurrency mixer. The money-laundering conviction is important because it addresses what happened after the smart-contract exploits, rather than treating the case only as unauthorized access to software. Independent reporting from TokenPost corroborated the two attack amounts, the use of Tornado Cash and the all-count verdict.

Crypto and collectibles were seized

Law enforcement seized cryptocurrency valued at approximately $31 million in February 2025 under a judicially authorized warrant. Prosecutors also described purchases made with proceeds from the attacks, including a Black Lotus trading card bought for about $500,000, sealed Magic: The Gathering and Pokemon products, antique Roman coins and a piece of Wright brothers aircraft fabric that had traveled to the moon. These details illustrate how investigators connected on-chain movements with physical assets, but they do not establish how much money victims will ultimately recover.

Why the case matters for DeFi

Uranium operated through smart contracts and liquidity pools rather than a conventional order-book exchange. The verdict shows that exploiting deployed code can still support traditional computer-fraud and money-laundering convictions when prosecutors prove deceptive access, theft and concealment. It also underscores a familiar DeFi risk: a flaw in withdrawal logic can affect many pools before operators or users can intervene. Technical permission to execute a transaction is not the same as legal authorization to take the assets.

What remains unresolved

Sentencing remains with the court, and the maximum penalties may be reduced under federal sentencing rules and the judge's findings. The Justice Department did not state how much of the seized cryptocurrency will be available for restitution, whether additional assets remain recoverable or when victims could receive distributions. The verdict settles criminal liability at trial, but it does not by itself complete the recovery process for former Uranium users.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.