Jonathan Spalletta, who also went by the online handles "Jspalletta" and "Cthulhon," was convicted on charges of computer fraud and money laundering. He surrendered to law enforcement on March 30, 2026, and was subsequently charged.
According to court documents, Spalletta first hacked Uranium Finance on April 8, 2021, draining about $1.4 million from its liquidity pool by exploiting a flaw in the exchange's smart contract code. He issued zero-token withdrawal commands that forced the exchange to pay rewards he was not entitled to. He then extorted the exchange into assigning a sham bug bounty of nearly $386,000 from the stolen funds to return the rest.
Three weeks later, Spalletta struck again, exploiting a separate coding error that caused the exchange's transaction-verification logic to use 1,000 instead of 10,000. This allowed him to withdraw nearly 90% of the assets held in Uranium's liquidity pools while depositing effectively zero tokens. The heist netted about $53.3 million, most of the exchange's holdings, and forced Uranium Finance to shut down immediately.
Spalletta laundered the stolen cryptocurrency through the Tornado Cash mixer and multiple decentralized exchanges. He used the proceeds to purchase collectibles, including 18 sealed packs of Alpha Booster Magic cards for around $1.5 million, a first-edition complete Pokémon base set for roughly $750,000, a "Black Lotus" Magic: The Gathering card for approximately $500,000, and an ancient Roman coin commemorating Julius Caesar's assassination for over $601,000.
Law enforcement seized these items from his residence in February 2025 and recovered roughly $31 million in cryptocurrency from wallets linked to Spalletta. Crypto fraud investigator ZachXBT had earlier linked over 11,200 Ether withdrawn from Tornado Cash to the Uranium hacker in December 2023.
In a statement, U.S. Attorney Jamie McDonald quoted Spalletta as saying, "Crypto is just fake internet money anyway," adding, "As Spalletta's many victims know, those words could not be further from the truth."