Jury Finds Uranium Finance Hacker Guilty in $55 Million DeFi Theft

Published October 7, 2026, 19:55 UTC. Based on Bloomberg's verdict report and the U.S. Department of Justice indictment announcement, with background from CoinDesk, The Crypto Times, the ABA Journal, and Inner City Press.

A Manhattan federal jury has found cybersecurity consultant Jonathan Spalletta guilty of stealing nearly $55 million from the Uranium Finance decentralized exchange, Bloomberg reported Wednesday. The jury deliberated for just over two hours before reaching its verdict. Spalletta faces up to 20 years in prison on the money-laundering count, and U.S. District Judge Jed Rakoff set sentencing for February 16, 2027.

Two hacks in April 2021

The case centered on two attacks against Uranium Finance, a Binance Smart Chain fork of the Uniswap automated market maker, in April 2021. The first, on April 8, drained about $1.4 million by looping the protocol's rewards contract. The second, on April 28, exploited a flaw in the pair contracts that let the attacker drain 26 liquidity pools at once, taking $53.3 million. The exchange never reopened.

According to the indictment unsealed by the Southern District of New York on March 30, 2026, Spalletta, 36, of Rockville, Maryland, negotiated a sham "bug bounty" after the first attack, returning most of the $1.4 million while keeping about $386,000, then came back twenty days later for the larger haul. Prosecutors say he laundered the proceeds through the Tornado Cash mixer between April 2021 and November 2023, moving on the order of $26 million.

The $31 million seizure

Agents searched Spalletta's Maryland home in February 2025 and seized about $31 million in cryptocurrency tied to the hacks, the Southern District of New York and Homeland Security Investigations announced. They also recovered the collectibles prosecutors say the proceeds bought: a Black Lotus Magic: The Gathering card purchased for $500,000, eighteen sealed Alpha booster packs worth $1.5 million, first-edition Pokémon card sets valued at over $1 million, an ancient Roman "Eid Mar" coin commemorating the assassination of Julius Caesar bought for about $601,500, and a fragment of fabric from the Wright brothers' airplane that astronaut Neil Armstrong later carried to the moon.

U.S. Attorney Jay Clayton said when the indictment was unsealed that "stealing from a crypto exchange is stealing," adding that "for the victims, there is nothing different about having your money taken."

Up to 30 years combined

Spalletta was charged with one count of computer fraud, which carries up to 10 years, and one count of money laundering, which carries up to 20. The defense argued at trial that he had only used publicly available functions within the smart contracts, Bloomberg reported, and denied that his actions amounted to hacking. The trial opened September 28 in the U.S. District Court for the Southern District of New York, with the case docketed as USA v. Spalletta, 1:26-cr-118, according to courtroom reporting by Inner City Press.

Victims of the Uranium Finance attacks were told by the Justice Department to contact UraniumVictims@hsi.dhs.gov.

This article is news reporting and is not investment advice.

Sources

• U.S. Attorney's Office for the Southern District of New York, indictment announcement (March 30, 2026), primary source
• Bloomberg, verdict report (Oct. 7, 2026), secondary source
• CoinDesk, Binance Chain DeFi Exchange Uranium Finance Loses $50M in Exploit (Apr. 28, 2021)
• CoinDesk, U.S. Law Enforcement Seizes $31M in Crypto Tied to Uranium Finance Hack (Feb. 24, 2025)
• The Crypto Times, Uranium Finance Trial Opens as Prosecutors Tell Jury $53M Drain Was Spalletta's Work (Oct. 1, 2026)
• ABA Journal, Pokemon fan charged with $55M crypto hack goes on trial (Sept. 30, 2026)
• Inner City Press, Spalletta Indicted for Uranium Finance Hack Now at Trial (Sept. 28, 2026)