We use essential cookies to make our site work. With your consent, we may also use non-essential cookies to improve user experience, personalize advertisements, and analyze web traffic. For these reasons, we may share your site usage data with our advertising and analytics partners. By clicking “Accept,” you agree to our website's cookie use as described in our Cookie Policy and Privacy Policy. You can change your cookie settings at any time by clicking “Preferences.”
    Skip to blog content

    Quality Crypto Reporting · Primary Sources Researched

    CryptoWorkPro

    Market context

    Powered by CoinStats APIUpdated 1:45 PM

    BTC-0.37%
    $80,383
    ETH-1.26%
    $2,336
    XRP+0.85%
    $1.30
    SOL-0.22%
    $100.99
    BNB+0.87%
    $737.38
    USDT+0.00%
    $0.9991
    USDC-0.01%
    $0.9996
    TRX-0.45%
    $0.3277
    STETH-1.45%
    $2,329
    ZEC+4.18%
    $1,204
    Back to Blog
    Crypto News

    Jury Convicts Man Over Uranium Finance Hacks That Took More Than $50 Million

    Published October 24, 2026

    A federal jury convicted Jonathan Spalletta on all counts over two 2021 Uranium Finance hacks. See what prosecutors said and what is unknown.

    A federal jury in New York has convicted Jonathan Spalletta of computer fraud and money laundering. Prosecutors say he took cryptocurrency from Uranium Finance, a crypto exchange, by using errors in its code in April 2021. The U.S. Attorney's Office for the Southern District of New York announced the verdict on Oct. 7, 2026.

    What the jury decided

    The jury convicted Spalletta on all counts after a six-day trial before U.S. District Judge Jed Rakoff, according to the Justice Department. He was convicted of one count of computer fraud, which carries a maximum sentence of 10 years, and one count of money laundering, which carries a maximum of 20 years. The Justice Department notes that the judge decides the actual sentence.

    Quartz, citing Bloomberg, reports that the jury took about two hours to reach its verdict and that sentencing is set for Feb. 16.

    What prosecutors say happened

    Uranium Finance was a decentralized exchange. Users put crypto into shared pots called liquidity pools, and the exchange's smart contracts used those pots to swap one token for another. A smart contract is a program that runs on a blockchain.

    Prosecutors describe two attacks:

    • April 8, 2021: Spalletta ran a series of transactions that let him withdraw far more "rewards" than he was allowed. He repeated them until he had drained nearly all the rewards tokens from the pool. The haul was worth about $1.4 million.
    • April 28, 2021: Prosecutors say he used an error in the contract that set how much he could withdraw from a liquidity pool. He did this across several pools and took about $53.3 million. Uranium shut down because it ran out of money.

    Together, the two figures add up to about $54.7 million. The Justice Department says the money lost was "over $50 million."

    The "bug bounty" claim and the money trail

    A bug bounty is a reward that a project pays a researcher who reports a flaw. Prosecutors say Spalletta wrote to another person about two weeks after the first attack that he had done a "crypto heist" and that there was "a bug in a smart contract, and I exploited it." They say he then pushed Uranium into letting him keep about $386,000 as a "sham" bug bounty, in return for sending back the rest.

    The Justice Department says he then moved the stolen funds through a series of transactions, including the Tornado Cash mixer. A mixer blends many people's transactions to make the money harder to trace.

    Prosecutors say he spent part of the money on collectibles. They include a "Black Lotus" Magic: The Gathering card for about $500,000, a first-edition Pokémon base set for about $750,000, and an ancient Roman coin for about $601,545. Law enforcement also seized crypto worth about $31 million, which prosecutors say came from the Uranium attacks, on Feb. 24, 2025.

    What the defense argued

    Quartz, citing Bloomberg, reports that defense lawyers told jurors the conduct was not hacking. They said Spalletta used functions in Uranium's smart contracts that anyone could reach, and that he did not use fake credentials or malicious code. Some crypto news sites have described this as a "code is law" defense. That label comes from press coverage, not from the Justice Department.

    The jury convicted on every count. We have not reviewed the trial record, so the defense argument here comes from press reports.

    What this does and does not show

    • It is one jury verdict in one trial. It is not a new law or a new regulation.
    • It shows that prosecutors brought computer fraud and money laundering charges over exploits of a smart contract, and that a jury convicted in this case.
    • Victims of the Uranium hacks are asked to contact UraniumVictims@hsi.dhs.gov, according to the Justice Department.

    What is still unknown

    • The sentence. Sentencing has not happened.
    • Whether Spalletta will appeal. The sources we reviewed do not say.
    • What happens to the seized crypto, and whether Uranium users will get any of it back. The Justice Department release does not address this.

    Sources

    Disclosure: This article is based on two U.S. Department of Justice announcements and news reports. Descriptions of what happened come from prosecutors, and the defense argument comes from press coverage. We did not review court transcripts, and the sentence has not been set. The featured image is a generated illustration, not a photo of the case. This article is not financial, legal, or investment advice. AI-assisted research and writing. Cited sources, not AI alone, support the claims.