From hacking to Pokémon cards: Uranium Finance hacker found guilty

Millions in crypto, then Pokémon cards. A federal jury in Manhattan found Jonathan Spalletta guilty of computer fraud and money laundering on October 7. This 36-year-old cybersecurity consultant, based in Rockville, Maryland, embezzled nearly $55 million during two attacks on Uranium Finance in April 2021. He then devoted part of the funds to rare collectibles, including a Pokémon card.

Key Points

The two attacks resulted in the embezzlement of approximately $1.4 million and then $53.3 million.

Jonathan Spalletta notably used Tornado Cash to launder funds, before purchasing cards and other rare items.

A multiplier error in the migration contract allowed funds to be withdrawn without compensation

His sentence must be pronounced on February 16, 2027: the two counts retained carry separate maximums of 10 and 20 years in prison.

Uranium Finance: Two attacks and nearly $55 million embezzled

Uranium Finance allowed users to deposit and trade cryptocurrencies using common reserves, called liquidity pools. Jonathan Spalletta twice used vulnerabilities in the programs that managed these operations.

On April 8, 2021, it targeted the reward distribution mechanism. By repeating trades, he withdrew more tokens than he was entitled to, amounting to approximately $1.4 million.

He later returned part of that sum, while keeping about $386,000 in a deal billed as a breach discovery bounty. The prosecution describes this “bonus” as an arrangement obtained under pressure to try to escape prosecution.

On April 28, Spalletta exploited another error, this time regarding the amounts he could withdraw from the pools. This second attack affected 26 reserves and resulted in the embezzlement of approximately $53.3 million. The losses led to the closure of Uranium Finance. The total of the two attacks therefore reaches approximately $54.7 million, before taking into account the funds returned after the first.

The defense argued that he had used public contract functions, “without spoofed identifiers or malicious code”. This argument did not prevent the jury from finding him guilty after a six-day trial.

From laundering to Pokémon cards and historical objects

After the attacks, the suspect moved the funds through a series of transactions, including using Tornado Cash, a cryptocurrency mixing service intended to make their journey more difficult to track.

Part of the money then financed collection purchases. Prosecutors cite a Black Lotus card from Magic: The Gathering acquired for approximately $500,000, as well as 18 sealed packs of Alpha cards for approximately $1.5 million. Purchases also include a $750,000 First Edition Pokémon set.

He also bought a Roman coin commemorating the assassination of Julius Caesar for more than $600,000 and a fragment of fabric from the Wright brothers' plane, taken to the Moon by Neil Armstrong, for around $137,500. Authorities seized several of these items from his home and, separately, $31 million in cryptocurrencies, valued at the time of their seizure in February 2025.

Judge Jed Rakoff set the sentencing hearing for February 16, 2027. Computer fraud is punishable by up to ten years in prison, compared to twenty years for money laundering.