U.S. authorities have unsealed an indictment against Jonathan Spalletta, the Maryland resident accused of hacking Uranium Finance, a now-defunct decentralized finance (DeFi) platform that lost over $54 million in two separate exploits in 2021.
The U.S. Attorney’s Office for the Southern District of New York announced Monday that Spalletta allegedly carried out the two hacks in April 2021. He also surrendered to authorities the same day.
In a statement, U.S. Attorney Jay Clayton said Spalletta took advantage of smart contract vulnerabilities to steal millions, forcing Uranium Finance to shut down due to insufficient funds.
“Stealing from a crypto exchange is still stealing—the notion that ‘crypto is different’ doesn’t change that. For the victims, losing their money is real, and Spalletta caused tens of millions in losses. Now, he’s facing real consequences,” Clayton said.
Launched in April 2021 during the crypto bull market, Uranium Finance was a BNB Chain fork of the automated market maker Uniswap. The platform’s website went offline after the second hack, leaving victims with few answers.
Two Hacks in the Same Month Cripple Uranium Finance
Uranium Finance was hit by a $1.4 million hack on April 8, 2021, just days after its launch. According to the U.S. Attorney’s Office for the Southern District of New York, a malicious actor exploited a smart contract to “withdraw far more rewards in cryptocurrency” than they were authorized to receive.
A private settlement between the platform and the hacker later recovered most of the stolen funds, leaving only $386,000 unrecovered.
A far larger attack followed on April 28. The hacker took advantage of a flaw in Uranium Finance’s smart contract governing withdrawal limits across 26 liquidity pools, stealing $53.3 million in crypto. The haul included Bitcoin (BTC), Ether (ETH), and the platform’s native “U92” tokens.
Stolen Funds Allegedly Spent on Collectibles
Prosecutors say the stolen cryptocurrency was used to buy collectibles, including Pokémon cards, antique Roman coins, and a piece of fabric from the Wright brothers’ original airplane. These items were seized during a search of Spalletta’s residence.
In February last year, authorities confiscated $31 million in crypto linked to the hack, though no details were released at the time.
Spalletta faces one count of computer fraud, punishable by up to 10 years in prison, and one count of money laundering, which carries a potential 20-year sentence. He was scheduled to appear before U.S. Magistrate Ona Wang on Monday to formally hear the charges.
In 2021, hackers reportedly stole over $2.6 billion through various exploits, with the largest attack targeting the cross-chain DeFi protocol Poly Network for $610 million. That hacker later returned the funds in what the team described as a white-hat action.
