Convicted Hacker Spalletta Laundered $50M Through Collectibles

A Manhattan jury has convicted Jonathan Spalletta of computer fraud and money laundering related to two hacks of the decentralized crypto exchange Uranium Finance in 2021. Spalletta, 36, from Rockville, Maryland, was found guilty on all counts after a six-day trial presided over by U.S. District Judge Jed S. Rakoff. He now faces a maximum of 10 years in prison for computer fraud and 20 years for money laundering.

The first hack occurred on April 8, 2021, when Spalletta exploited Uranium's smart contract to withdraw approximately $1.4 million in rewards to which he was not entitled. Following this, he pressured the exchange into allowing him to keep around $386,000 as a supposed "bug bounty" in exchange for returning the remaining funds. Just two weeks later, he boasted about his exploits in a message, stating, "I did a crypto heist of $1.5MM a couple of weeks ago . . . Crypto is all fake internet money anyway."

On April 28, 2021, Spalletta executed a second hack by taking advantage of a flaw in the contract's withdrawal calculations across various liquidity pools, resulting in a staggering theft of about $53.3 million. This incident led to Uranium Finance shutting down due to a lack of funds. U.S. Attorney Jamie McDonald emphasized the impact of Spalletta's actions, noting that his crimes caused real financial losses for individuals and led to the collapse of an entire crypto platform.

Laundering Through High-Value Collectibles

Spalletta laundered the stolen funds through a series of transactions, including using the coin mixer Tornado Cash. He then spent the illicit gains on a variety of collectibles, including a Black Lotus card from Magic: The Gathering for about $500,000 and 18 sealed packs of Alpha Booster cards for approximately $1.5 million. In addition, he purchased a first edition complete base set of Pokémon cards for about $750,000 and a sealed box of first edition booster packs for around $257,500.

The Unraveling

His spending spree also included a Roman coin, the Eid Mar denarius, commemorating Julius Caesar's assassination, which he bought for about $601,545, and a piece of fabric from the Wright brothers' original airplane that Neil Armstrong carried to the moon, costing about $137,500. Authorities seized the Black Lotus card, the fabric, and some of the coins from Spalletta's home under a search warrant. In February 2025, they seized cryptocurrency worth about $31 million linked to the Uranium hacks.

Prosecutors are actively seeking individuals who believe they were victims of the Uranium hacks to come forward and contact Homeland Security Investigations.