Uranium Finance hacker sentenced and faces 20 years in prison for stealing $55 million

New York jury has found cybersecurity consultant Jonathan Spalletta guilty of computer fraud and money laundering

A New York jury has found cybersecurity consultant Jonathan Spalletta guilty of computer fraud and money laundering in two attacks on Uranium Finance. The two attacks resulted in the theft of nearly $55 million in funds. Among them, money laundering is punishable by up to 20 years in prison.

Trial results and sentencing arrangements

After a six-day federal jury trial in Manhattan, Spaletta was found guilty on both charges. The U.S. Attorney's Office for the Southern Central District announced on October 7 that the 36-year-old defendant from Rockville, Maryland, was found guilty of all crimes on the indictment in a trial presided over by U.S. District Judge Jed Rakoff.

According to Bloomberg, the jury reached its verdict after more than two hours of deliberation, and Judge Rakoff has set the sentencing date for February 16. Reported that defense lawyers had argued that Spaleta was using publicly available smart contract features rather than forged certificates or malicious code.

The prosecutor's office stated in a statement that computer fraud charges carry a maximum sentence of 10 years, while money laundering charges carry a maximum sentence of 20 years. The office emphasized that these prison limits will be set by Congress and the actual sentences will be decided by judges.

Two April attacks extract funds from reward and trading pools

According to prosecutors, Uranium Finance allows users to deposit and exchange cryptocurrencies through a liquidity pool. On April 8, 2021, Spaleta launched its first attack, targeting smart contracts that pay cryptocurrency rewards.

Prosecutors stated that by repeating a series of transactions, he withdrew rewards far more than he was entitled to and emptied almost all reward tokens in the affected pool. The office estimated that the value of the cryptocurrency stolen in the attack was approximately $1.4 million.

Prosecutors pointed out that about two weeks later, Spaleta sent another person a written message describing his actions:

"I conducted a $1.5 million crypto robbery a few weeks ago... There was a loophole in smart contracts and I took advantage of it... Cryptocurrencies are fake online currencies anyway."

After the theft, Spaleta forced Uranium to accept an arrangement: he retained approximately $386,000 and returned the remaining funds. Prosecutors described the retention money as a false "loophole bounty" designed to help him evade prosecution.

Regarding the second attack on April 28, 2021, prosecutors claimed that he exploited errors in the contract governing withdrawals from the liquidity pool. The initial indictment announcement identified 26 affected pools with approximately $53.3 million in stolen cryptocurrency; while the sentencing announcement stated that the loss forced Uranium to shut down its platform.

早在2021年4月，关于该平台5000万美元被盗事件的报道引用了Uranium的公告，称事故发生在其迁移至2.1版本期间。同一报道指出，该项目正在与币安（Binance）的安全团队合作，并要求用户通过他们的币安账户报告被盗资金。

追踪洗钱过程与数百万美元的物品购买

检察官办公室表示，攻击发生后，斯帕莱塔通过一系列加密货币交易转移被盗资产，包括使用混币服务Tornado Cash，随后将部分收益用于购买收藏品。

2024年1月的独立报道记录了一笔从标记为Uranium黑客地址发出的250万BUSDT转账。援引PeckShield的报告称，资金通过Li.fi从BNB Chain转移至以太坊网络，接收地址获得了812枚ETH和约50.5万美元的稳定币。

在斯帕莱塔的购买清单中，检察官列出了一张价值约50万美元的黑莲花《万智牌》卡牌，以及18包未开封的Alpha补充包，总价值约151.25万美元。该办公室还确认他花费约25.75万美元购买了一盒初版宝可梦补充包，以及一套完整的初版宝可梦基础卡组，价值约75万美元。

In addition to the exchangeable cards, prosecutors said he also spent approximately $601,545 on an ancient Roman coin "Ide Martinarius" to commemorate the assassination of Julius Caesar. Another purchase, according to the office, was a piece of fabric worth $137,500 from the Wright brothers 'original plane, which Neil Armstrong later took to the moon.

U.S. investigators seize assets and provide victim contact information

The Justice Department said that under a court-authorized search warrant, investigators seized black lotus cards, aircraft fabric and ancient Roman coins from Spaleta's residence. Bloomberg reported that rare Pokémon and Magic cards seized from their Maryland residence were worth more than $3 million.

In addition, the U.S. Attorney's Office stated that law enforcement seized cryptocurrency related to the Uranium theft on February 24, 2025. The assets were valued at approximately $31 million at the time of seizure.

For affected users, the office instructed in an October 7 announcement that anyone who believes they are a victim of the Uranium hack should contact the Department of Homeland Security Bureau of Investigation (HSI) at Uranium Victims @ hsi. dhs. gov.