Hacker Convicted in $53 Million Uranium Crypto Exchange Heist

Post Views: 9

Uranium crypto exchange hacker convicted for stealing $53 million

The Crime

A Maryland man was found guilty of stealing more than $53 million after hacking the decentralized crypto exchange Uranium Finance twice in April 2021. 36-year-old Jonathan Spalletta (also known online as “Jspalletta” and “Cthulhon”) surrendered to law enforcement on March 30 and was charged with computer fraud and money laundering. According to court documents, Spalletta hacked Uranium (an automated market maker on Binance’s BNB Chain) and stole nearly $53.3 million in cryptocurrency, forcing the company to shut down for lack of funds.

First Attack

On April 8, 2021, during the first breach, he siphoned approximately $1.4 million from Uranium’s liquidity pool by exploiting a vulnerability in its smart contract code to generate zero-token withdrawal commands, which triggered unauthorized reward payouts. Spalletta then demanded the crypto exchange allocate a fraudulent “bug bounty” of nearly $386,000 from the stolen funds to recover the remainder.

Second Attack

Three weeks later, he executed a second attack by leveraging a separate coding flaw that caused the exchange’s transaction-verification logic to use 1,000 instead of 10,000, enabling him to withdraw nearly 90% of assets held in Uranium’s liquidity pools while depositing negligible tokens. This operation yielded Spalletta about $53.3 million (most of Uranium’s reserves) and prompted the platform’s immediate collapse.

The Aftermath

Subsequently, Spalletta obscured the illicit proceeds by routing the cryptocurrency through the Tornado Cash mixer and multiple decentralized exchanges. Investigators traced the stolen funds, revealing that the proceeds were used to purchase 18 sealed packs of Alpha Booster Magic cards costing around $1.5 million, a first-edition complete Pokémon base set valued at roughly $750,000, a “Black Lotus” Magic: The Gathering card priced at approximately $500,000, an ancient Roman coin commemorating Julius Caesar’s assassination exceeding $601,000, and other collectibles.

Law enforcement recovered these items from his residence in February 2025 and seized approximately $31 million in cryptocurrency from wallets linked to Spalletta. Crypto fraud analyst ZachXBT connected over 11,200 ETH withdrawn from Tornado Cash (worth $25 million at the time) to the Uranium hacker in December 2023.

Legal Consequences

“Spalletta’s own statements reflect his alarming disregard for the harm inflicted on victims, as he claimed, ‘Crypto is just fake internet money anyway.’ As those affected by his actions can attest, this assertion is profoundly inaccurate,” stated U.S. Attorney Jamie McDonald. “Spalletta’s offenses resulted in genuine financial losses exceeding $50 million and the destruction of a cryptocurrency platform.”

Sentencing

Spalletta now faces up to 10 years in prison for computer fraud and up to 20 years for money laundering.

Conclusion

The case highlights the severe financial and operational damage caused by cryptocurrency hacks, as well as the ongoing efforts by law enforcement to trace and recover illicit funds. Spalletta’s actions not only devastated a crypto platform but also led to the seizure of millions in assets and a significant prison sentence.