Jury convicts Uranium Finance hacker over $53.3 million exploit

A Manhattan federal jury convicted Jonathan Spalletta on October 7 of computer fraud and money laundering for two 2021 attacks on Uranium Finance, converting a five-year-old decentralized-finance exploit from an allegation into a criminal verdict.

The conviction matters beyond the failed exchange because the evidence distinguished unauthorized exploitation from legitimate security research. Prosecutors said Spalletta repeatedly manipulated vulnerable smart contracts, then pressured Uranium to characterize part of the first theft as a bug bounty. The verdict does not itself determine his sentence or establish that victims will recover their losses.

Two exploits, two different code failures

According to the U.S. Attorney’s Office for the Southern District of New York, the first attack occurred on April 8, 2021. Spalletta used a series of transactions to withdraw more reward tokens than Uranium’s contracts authorized, repeating the method until the relevant liquidity pool was nearly drained. Prosecutors valued the cryptocurrency extracted in that attack at approximately $1.4 million at the time.

Uranium later agreed to let him keep approximately $386,000 in exchange for returning the rest. The government characterized that arrangement as a sham bug bounty obtained through extortion, not retroactive authorization for the exploit. That distinction is important: a vulnerability’s existence does not by itself give a user permission to take assets or force a protocol to negotiate after the fact.

The second attack occurred on April 28, 2021. Trial evidence showed that Spalletta exploited an error in the contract logic governing withdrawals across multiple liquidity pools. The Justice Department valued the cryptocurrency obtained in that attack at approximately $53.3 million when it was taken. Uranium then shut down because it lacked funds.

BleepingComputer reported that the flawed verification logic used 1,000 where 10,000 was required, allowing withdrawals representing nearly 90% of the affected pools’ assets while effectively depositing no tokens. That technical description comes from the opened secondary report; the Justice Department release establishes the verdict, dates and government valuation.

Mixer use became part of the laundering case

The jury also convicted Spalletta of laundering the proceeds through a series of cryptocurrency transactions that included Tornado Cash. The verdict concerns his conduct with stolen assets; it is not a general ruling that every use of a mixer or decentralized exchange constitutes money laundering.

Authorities said they seized cryptocurrency linked to the Uranium theft on February 24, 2025. That property was worth approximately $31 million at the time of seizure. The figure is a point-in-time valuation, not the amount returned to victims, the present value of the assets or a recovery percentage. The government release asks potential victims to contact Homeland Security Investigations but does not say distributions have occurred.

Prosecutors also traced proceeds to physical collectibles, several of which were recovered under a judicially authorized search warrant. Those purchases helped connect digital proceeds to assets outside the blockchain, but they do not resolve how much value ultimately can be forfeited or restored.

Conviction is not sentencing or restitution

Spalletta was convicted on all counts after a six-day trial before U.S. District Judge Jed S. Rakoff. The computer-fraud count carries a statutory maximum of 10 years in prison, while the money-laundering count carries a statutory maximum of 20 years. Those are maximum penalties prescribed by Congress, not a forecast of the sentence the judge will impose.

The October 7 verdict establishes criminal liability for the charged conduct. It does not set a sentencing date in the cited Justice Department release, quantify final restitution or show whether the seized cryptocurrency will cover validated victim claims. Those remain the principal follow-up questions for the case.