Jonathan Spalletta: Convicted of Draining $54M From Uranium Finance

On 7 October 2026 a Manhattan jury convicted Jonathan Spalletta of hacking the crypto exchange Uranium Finance twice in 2021, taking more than $54 million and spending it on Magic: The Gathering cards, Pokémon cards and ancient Roman coins. After a six-day trial he was found guilty on every count: computer fraud and money laundering.

Spalletta, 36, of Rockville, Maryland, went by "Cthulhon" online. The jury heard that he had once summed up his view of the victims in a message to an acquaintance: "Crypto is all fake internet money anyway."

Two raids on one exchange

Uranium Finance was a small exchange on BNB Chain, a crypto network, where people pooled their coins so others could swap between them, a little like a currency exchange stocked by its own customers, who earned a share of the fees in return.

On 8 April 2021 Spalletta found a flaw in Uranium's code, the program that paid out those rewards. By repeating a series of transactions over and over, he collected far more rewards than he was entitled to, until he had drained nearly all of them: about $1.4 million. Two weeks later he wrote to someone: "I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it."

Then he struck a deal. Prosecutors told the jury he pushed Uranium into letting him keep about $386,000 as a "bug bounty", the reward companies pay people who report flaws, in return for handing back the rest. The Justice Department called it a sham, designed to help him avoid prosecution.

Three weeks later, on 28 April 2021, he hit Uranium again. This time a single wrong figure in the code, 1,000 where 10,000 belonged, let him withdraw far more than he was owed from pool after pool. He took about $53.3 million. Uranium ran out of money and closed for good.

Magic cards and moon fabric

Spalletta then hid the money's trail, including through Tornado Cash, a service that mixes many people's crypto together so individual payments are hard to follow, and went shopping. According to the evidence at trial, he bought:

A "Black Lotus", the most famous card in Magic: The Gathering, for about $500,000.

Eighteen sealed packs of "Alpha" Magic cards, from the game's first print run, for about $1.5 million.

A sealed box of first-edition Pokémon cards for about $257,500, and a complete first-edition set for about $750,000.

A piece of fabric from the Wright brothers' first aeroplane that Neil Armstrong carried to the Moon, for about $137,500.

An "Eid Mar" denarius, a Roman silver coin made to celebrate the assassination of Julius Caesar, for about $601,545.

Caught four years later

The trail did not go cold. Investigators from Homeland Security Investigations, with the blockchain analysis firm TRM Labs, followed the money across networks. On 24 February 2025 agents seized about $31 million in crypto from him and searched his home, where they found the Black Lotus, the moon fabric and the Roman coins.

He was charged in New York and surrendered on 30 March 2026. At the time, the then US Attorney, Jay Clayton, said: "Stealing from a crypto exchange is stealing." Spalletta pleaded not guilty and went to trial before Judge Jed S. Rakoff on 28 September 2026.

The jury took his own words seriously. Announcing the verdict, US Attorney Jamie McDonald quoted the "fake internet money" line back at him: "As Spalletta's many victims know, those words could not be further from the truth. Spalletta's crimes cost real people to lose real money."

What happens now

Computer fraud carries up to 10 years in prison and money laundering up to 20. The judge will decide the sentence; no date has been announced.

For the people who had money in Uranium's pools, the government has set up a contact address, UraniumVictims@hsi.dhs.gov, for anyone who believes they lost money in the hacks. The $31 million seized in 2025 and the collectibles may in time go some way towards repaying them, but Uranium itself is gone.