5470万美元DeFi黑客因用盗窃资金购买宝可梦卡牌和黑莲花而被定罪

Manhattan federal jury has found Maryland cybersecurity consultant guilty of hacking Uranium Finance to steal $54.7 million

A Manhattan federal jury has found Maryland cybersecurity consultant Jonathan Spalletta guilty. In two hacking attacks in April 2021, he stole approximately $54.7 million from decentralized exchange Uranium Finance.

The plot of this case is like a crazy dream of cryptocurrency and collectibles intertwined: stolen funds are circulated through the Tornado Cash mixer and then used to buy one of the most expensive Magic cards in history, a set of first-edition Pokémon cards, an ancient Roman coin, and a piece of fabric that once accompanied astronauts to the moon.

Verdict

On Wednesday, October 7, after a six-day trial, a jury presided over by U.S. District Judge Jed Rakoff found Spaletta, 36, of Rockville, Maryland, guilty of two counts: computer fraud and money laundering. Computer fraud carries a maximum penalty of 10 years in prison, and money laundering carries a maximum penalty of 20 years in prison. In the online world, Spalletta used aliases such as "Cthulhon" and "Jspalletta".

"Spaleta's criminal behavior caused ordinary people to lose real currency in an amount of more than $50 million and caused the entire cryptocurrency platform to collapse," U.S. prosecutor Jamie McDonald said. The U.S. Attorney's Office for the Southern District of New York added that its prosecutors and agency partners had ensured that its "criminal conduct in the virtual world ends in a real-world criminal conviction."

First hack: Vulnerability and so-called "bounty"

Uranium Finance is a decentralized exchange where users exchange tokens through a liquidity pool. According to prosecutors, Spaleta launched its first attack on April 8, 2021, extracting far more than its fair share of proceeds and stealing approximately $1.4 million by repeating a series of transactions on Uranium's smart contracts.

He then pressured the project team to retain approximately US$386,000 as a "bug bounty" in exchange for returning the rest of the money. Prosecutors believe the reward was a cover. Two weeks later, he wrote to another person: "I carried out a $1.5 million cryptocurrency theft a few weeks ago... There were loopholes in smart contracts that I took advantage of... Cryptocurrencies are fake Internet currencies anyway."

Second hack: $53.3 million robbery

Only 20 days after the first attack, on April 28, 2021, he launched another attack. This time he used a contract error in calculating withdrawals from multiple liquidity pools to steal approximately $53.3 million. Due to huge financial losses, Uranium Finance was unable to maintain operations and eventually closed down.

The "code is law" defense failed

Spaleta's lawyers argued that prosecutors could not prove "whose finger was typing on the keyboard," pointing out that he did not write Uranium's defective code and that Tornado Cash was simply a privacy tool. The jury rejected those arguments. The verdict was reportedly handed down after approximately two hours of deliberation. After the verdict was pronounced, prosecutors requested GPS monitoring of Spaleta.

Laundering money through Tornado Cash

Prosecutors said Spaleta transferred the stolen money through a series of transactions, including Ethereum hybrid service Tornado Cash, designed to conceal the source and destination of the funds. Media reports show that between April 2021 and November 2023, approximately US$26 million in funds flowed through the currency mixer.

Shopping list

The reason why this case made headlines is where the stolen money went. According to the Department of Justice and trial evidence:

• Magic: A black lotus card is worth approximately US$500,000, plus 18 unopened Alpha supplement packs, worth approximately US$1.5 million.
• Pokémon: A complete first-edition basic package worth approximately US$750,000; a box of unopened first-edition supplementary packages worth approximately US$257,500.
• Ancient history: An Eid Mar denarius, an ancient Roman coin commemorating the assassination of Julius Caesar, is worth approximately US$601,545.
• Space memorabilia: A piece of fabric from the Wright brothers 'original plane, carried to the moon by Neil Armstrong, worth approximately $137,500.

This is a large pile of cardboard and fabric, and coincidentally echoes a trend that cryptocurrency readers have noticed recently: Pokémon cards will outperform Bitcoin in 2026, and Coinbase recently announced the launch of Pokémon Card Pack products.

Government recovery

Investigators seized black lotus cards, fragments of the Wright brothers 'fabric and some coins from Spaleta's home based on a court-authorized search warrant. In February 2025, authorities also seized approximately US$31 million worth of cryptocurrency obtained from Uranium hacking (based on market value at the time). Prosecutors are calling on any victims who believe they have been affected by the Uranium hack to contact the Homeland Security Investigation Bureau.

Why cryptocurrency users should pay attention to this case

This case comes in a year when the security of decentralized finance (DeFi) has been severely tested, with tens of billions of dollars stolen by exploits on different exchanges and protocols. It reminds people of three points:

1. Exploiting is an indictable crime. [TAG 65] Although the contract logic was indeed flawed, the argument that the code allowed this failed before the jury.
2. “漏洞赏金”并非免死金牌。在拿走部分赃款后归还剩余部分，并不能为其开脱。
3. 混币器无法抹去踪迹。资金虽然通过了 Tornado Cash，但调查人员仍将其追踪至其家中的资产以及被扣押的 3100 万美元加密货币。

对于 Uranium 的用户和团队而言，损害是永久性的：该交易所从未恢复元气。

后续进展

在我查阅的报道中，尚未公布斯帕莱塔的宣判日期。鉴于两项罪名均成立，他面临总共 30 年的潜在刑期，尽管实际判决通常较低。目前，此案作为一个警示故事，记录了 DeFi “黑客事件之后会发生什么”这一章节：代码在几分钟内被利用，但其后果历时五年多才得以显现。