U.S. Man Convicted of $50 Million Crypto Heist on Uranium Finance, Boasted “Crypto Is All Fake Internet Money Anyway”

A Maryland man is facing decades behind bars after a federal jury found him guilty of hacking a decentralized cryptocurrency exchange and walking away with tens of millions of dollars.

Jonathan Spalletta, 36, of Rockville, Maryland, was convicted on all counts of an indictment one count of computer fraud, which carries a maximum sentence of 10 years in prison, and one count of money laundering, which carries up to 20 years following a six day jury trial. The verdict was announced in connection with his attacks on Uranium Finance, a decentralized exchange that allowed users to deposit and swap different cryptocurrencies through liquidity pools.

According to court documents, public filings, and evidence presented at trial, Spalletta carried out two separate hacks of the platform in April 2021.

The first hack came on April 8, 2021. Prosecutors said Spalletta manipulated Uranium’s smart contract through a deceptive series of transactions, withdrawing far more in “rewards” than he was ever authorized to receive. He repeated the transactions until he had drained nearly all the reward tokens from the liquidity pool, extracting cryptocurrency worth roughly $1.4 million.

About two weeks later, according to a statement from the Department of Justice, Spalletta bragged to another person in writing: “I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway.”

He then allegedly extorted Uranium into letting him keep about $386,000 of the stolen funds as a sham “bug bounty,” a move prosecutors said was designed to help him evade prosecution in exchange for returning the rest of the money.

But Spalletta wasn’t finished. On April 28, 2021, he exploited another error in the Uranium smart contract this time in the code governing how much cryptocurrency he could withdraw from a liquidity pool. He used the flaw across multiple Uranium liquidity pools, fraudulently obtaining about $53.3 million in cryptocurrency and causing the exchange to shut down entirely due to a lack of funds.

To cover his tracks, Spalletta laundered the stolen funds through a complex web of cryptocurrency transactions, including the crypto mixer Tornado Cash. After cleaning the money, he used it to buy personal collectible items, according to the evidence presented at trial.

Law enforcement later seized cryptocurrency worth approximately $31 million at the time of seizure on February 24, 2025, pursuant to a judicially authorized seizure warrant. That seizure represented funds Spalletta had fraudulently obtained from Uranium.

The case underscores growing scrutiny of decentralized finance platforms, where code vulnerabilities can be exploited for massive paydays and where bragging about the crime can later become key evidence in court. Spalletta now awaits sentencing, where he could face up to 30 years in prison combined on the two counts.