Uranium Finance Hacker Who Bought Pokémon and Magic Cards Convicted Over $50M Theft

In brief

• A Manhattan jury convicted Jonathan Spalletta of computer fraud and money laundering over two 2021 hacks of decentralized exchange Uranium Finance.
• Spalletta stole more than $50 million, laundered it through Tornado Cash, and spent it on rare Magic: The Gathering and Pokémon cards.
• Authorities seized cryptocurrency from the hacks worth about $31 million at the time of seizure in February 2025.

A Manhattan jury has convicted Jonathan Spalletta of computer fraud and money laundering over two 2021 hacks of decentralized crypto exchange Uranium Finance, federal prosecutors said Wednesday.

Spalletta, 36, of Rockville, Maryland, was charged over the exploits in March. He was convicted on all counts after a six-day trial before U.S. District Judge Jed S. Rakoff, and faces a maximum of 10 years in prison for computer fraud and 20 years for money laundering.

In the first hack, on April 8, 2021, Spalletta repeated a series of transactions with Uranium's smart contract to withdraw far more rewards than he was entitled to, taking about $1.4 million.

He then pressured Uranium into letting him keep about $386,000 as what prosecutors called a sham "bug bounty" in exchange for returning the rest.