Maryland Man Charged With Hacking Uranium Finance DeFi Exchange for $50 Million in 2021

TLDR

• Jonathan Spalletta, 36, of Rockville, Maryland, has been charged with computer fraud and money laundering
• He allegedly hacked Uranium Finance twice in April 2021, stealing over $50 million
• Proceeds were laundered through Tornado Cash and spent on rare collectibles
• Authorities seized $31 million in crypto tied to the hack in February 2025
• Spalletta faces up to 30 years in prison if convicted on both counts

Jonathan Spalletta, a 36-year-old Maryland resident, has been charged by federal prosecutors for two hacks against decentralized exchange Uranium Finance in April 2021 that drained over $50 million from the platform.

The indictment was unsealed by the Southern District of New York on Monday. Spalletta surrendered to authorities in Manhattan the same day and appeared before U.S. Magistrate Ona Wang.

Uranium Finance was a BNB Chain fork of the automated market maker Uniswap. It launched in April 2021 and shut down shortly after the attacks due to a lack of funds.

The first hack occurred on April 8, 2021, just days after launch. Spalletta allegedly exploited a flaw in Uranium’s rewards mechanism to withdraw far more cryptocurrency than he was authorized to receive, taking roughly $1.4 million.

After the first hack, a private deal was reached. Spalletta negotiated what prosecutors describe as a sham “bug bounty,” returning most of the funds but keeping around $386,000.

The second and larger attack came on April 28, 2021. Spalletta allegedly exploited an error in the smart contract governing withdrawal limits across 26 liquidity pools, stealing $53.3 million in crypto including Bitcoin, Ether, and Uranium’s native token U92.

Following the second hack, Uranium Finance shut down its website and victims were left with little information about what happened or who was responsible.

In February 2025, authorities seized approximately $31 million in cryptocurrency tied to the exploits. At the time, no details were released about a suspect.

How the Stolen Funds Were Spent

Prosecutors allege Spalletta laundered the stolen crypto through a series of complex transactions, including the use of Tornado Cash, a crypto mixing service.

He then allegedly spent the proceeds on high-value collectibles. These included a Black Lotus Magic: The Gathering card for around $500,000 and 18 sealed Alpha booster packs for roughly $1.5 million.

He also allegedly purchased first-edition Pokémon sets worth over $1 million, an ancient Roman “Eid Mar” coin for about $601,500, and a piece of fabric from the Wright brothers’ original airplane. Items were seized during a search of his residence.

Charges and Potential Sentence

Spalletta faces one count of computer fraud, which carries up to 10 years in prison, and one count of money laundering, which carries up to 20 years.

The charges mark the first time a named defendant has been publicly linked to the Uranium Finance case, more than four years after the hacks took place.

The post Maryland Man Charged With Hacking Uranium Finance DeFi Exchange for $50 Million in 2021 appeared first on CoinCentral.