Jonathan Spalletta has been convicted of computer fraud and money laundering in connection with his hacks of the decentralised cryptocurrency exchange Uranium Finance. Mr Spalletta was convicted on all counts in the Indictment following a six-day jury trial.
Mr Spalletta, 36, of Rockville, Maryland, was convicted of one count of computer fraud, which carries a maximum sentence of 10 years in prison, and one count of money laundering, which carries a maximum sentence of 20 years in prison.
According to the indictment, public filings, and evidence presented at trial, Uranium was a decentralised cryptocurrency exchange that let users deposit and exchange different kinds of cryptocurrencies via liquidity pools. In April 2021, Mr Spalletta committed two separate hacks of Uranium.
In the first hack, on April 8, 2021, Mr Spalletta engaged in a deceptive series of transactions with Uranium’s smart contract, which he used to withdraw far more “rewards” in cryptocurrency than he was authorised to receive. He repeated those transactions until he drained the liquidity pool of nearly all its reward tokens.
In total, Mr Spalletta successfully extracted cryptocurrency worth approximately $1.4 million in the first hack. Approximately two weeks after he fraudulently obtained the funds, according to a statement by the Department of Justice, Mr Spalletta told another individual in writing, “I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway.”
Mr Spalletta subsequently extorted Uranium into agreeing to let him keep approximately $386,000 of the money he stole as a sham “bug bounty” to help him evade prosecution, in exchange for returning the remainder of the stolen money to Uranium.
In the second hack, on April 28, 2021, Mr Spalletta exploited an error in the Uranium smart contract that governed how much cryptocurrency he could withdraw in a liquidity pool on Uranium. He exploited that issue across multiple Uranium liquidity pools, fraudulently obtaining about $53.3 million in cryptocurrency and causing Uranium to shut down due to a lack of funds.
Mr Spalletta then laundered the funds he had fraudulently obtained from Uranium through a complex series of cryptocurrency transactions, including by using the cryptocurrency mixer Tornado Cash.
After laundering the funds, Mr Spalletta used the money he had fraudulently obtained to purchase personal collectable items.
In addition, on February 24, 2025, law enforcement seized, pursuant to a judicially authorised seizure warrant, cryptocurrency worth approximately $31 million at the time of seizure that Mr Spalletta had fraudulently obtained from Uranium.