Maryland Man Charged in $53M Cryptocurrency Heist Targeting Uranium Finance A 36-year-old Maryland man, Jonathan Spalletta, has been charged with stealing over $53 million from the Uranium Finance cryptocurrency exchange in two separate attacks in April 2021. The alleged breaches exploited vulnerabilities in the platform’s smart contract code, draining nearly 90% of its assets and forcing its shutdown. Prosecutors allege Spalletta manipulated a rewards system to withdraw $1.4 million, negotiated a fraudulent $386,000 bug bounty, and later exploited a coding error to siphon funds from 26 liquidity pools. The second attack, occurring three weeks after the first, resulted in the theft of approximately $53.3 million. The stolen cryptocurrency was laundered through decentralized exchanges and the Tornado Cash mixer before being used to purchase rare collectibles, including trading cards and an ancient coin. In February 2025, authorities seized assets from Spalletta’s residence, recovering about $31 million in cryptocurrency tied to the case. Spalletta faces charges of computer fraud (up to 10 years in prison) and money laundering (up to 20 years). U.S. Attorney Jay Clayton emphasized that the case underscores the risks of vulnerabilities in decentralized finance platforms.

U.S. Prosecutors Charge Maryland Man in $53 Million Uranium Finance Crypto Heist A 36-year-old Maryland man, Jonathan Spalletta (also known online as "Cthulhon" and "Jspalletta"), has been charged with stealing over $53 million from the decentralized cryptocurrency exchange Uranium Finance in two separate attacks in April 2021. Spalletta surrendered to authorities on Monday and appeared in court before U.S. Magistrate Judge Ona T. Wang. The attacks targeted Uranium, an automated market maker similar to Uniswap, exploiting vulnerabilities in its smart contract code. The first breach, on April 8, involved manipulating the AmountWithBonus variable to drain $1.4 million from the exchange’s liquidity pool. Spalletta then extorted Uranium into paying a $386,000 "bug bounty" in exchange for returning the remaining stolen funds. On April 28, he struck again, exploiting a single-character coding error that allowed him to withdraw nearly 90% of the exchange’s assets approximately $53.3 million across 26 liquidity pools. The theft forced Uranium Finance to shut down immediately. Prosecutors allege Spalletta laundered the stolen funds through the Tornado Cash cryptocurrency mixer and spent the proceeds on high-value collectibles, including a $500,000 Black Lotus Magic: The Gathering card, $1.5 million in sealed Alpha Booster packs, a $750,000 first-edition Pokémon base set, and a $601,000 ancient Roman coin commemorating Julius Caesar’s assassination. In February 2025, law enforcement seized the collectibles from Spalletta’s residence and recovered roughly $31 million in cryptocurrency from linked wallets. He faces up to 10 years in prison for computer fraud and up to 20 years for money laundering. U.S. Attorney Jay Clayton emphasized that the case underscores the real-world consequences of crypto theft, stating, "Stealing from a crypto exchange is stealing there is nothing different about having your money taken."