Uranium Finance Hacker Who Bought Pokémon and Magic Cards Convicted Over $50M Theft

In brief

• A Manhattan jury convicted Jonathan Spalletta of computer fraud and money laundering over two 2021 hacks of decentralized exchange Uranium Finance.
• Spalletta stole more than $50 million, laundered it through Tornado Cash, and spent it on rare Magic: The Gathering and Pokémon cards.
• Authorities seized cryptocurrency from the hacks worth about $31 million at the time of seizure in February 2025.

A Manhattan jury has convicted Jonathan Spalletta of computer fraud and money laundering over two 2021 hacks of decentralized crypto exchange Uranium Finance, federal prosecutors said Wednesday.

Spalletta, 36, of Rockville, Maryland, was charged over the exploits in March. He was convicted on all counts after a six-day trial before U.S. District Judge Jed S. Rakoff, and faces a maximum of 10 years in prison for computer fraud and 20 years for money laundering.

Jonathan Spalletta convicted for defrauding crypto exchange of over $50 million in hacks: “Our prosecutors of the Office and our agency partners have done outstanding work to ensure Spaletta’s virtual world criminal conduct ended in his real-world criminal conviction,” said USA…

— US Attorney SDNY (@SDNYnews) October 7, 2026

In the first hack, on April 8, 2021, Spalletta repeated a series of transactions with Uranium’s smart contract to withdraw far more rewards than he was entitled to, taking about $1.4 million.

He then pressured Uranium into letting him keep about $386,000 as what prosecutors called a sham “bug bounty” in exchange for returning the rest.

Two weeks after that hack, he wrote to another person: “I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway.”

On April 28, 2021, he exploited an error in how the contract calculated withdrawals across several liquidity pools, taking about $53.3 million and causing Uranium to shut down for lack of funds.

“Spalletta’s crimes cost real people to lose real money—over $50 million dollars—and caused an entire crypto platform to collapse,” said U.S. Attorney Jamie McDonald.

Black Lotus and Roman coins

Spalletta laundered the funds through a series of transactions, including through coin mixer Tornado Cash, then spent them on collectibles including Magic: The Gathering and Pokémon cards.

His Magic: The Gathering purchases included a Black Lotus card for about $500,000 and 18 sealed packs of Alpha Booster cards for about $1.5 million. For Pokémon, he paid about $750,000 for a first edition complete base set and about $257,500 for a sealed box of first edition booster packs.

He also bought an Eid Mar denarius, a Roman coin commemorating the assassination of Julius Caesar, for about $601,545, and a piece of fabric from the Wright brothers’ original airplane that Neil Armstrong carried to the moon, for about $137,500.

The Black Lotus, the fabric and some of the coins were seized from his home under a search warrant. In February 2025, authorities also seized cryptocurrency from the Uranium hacks worth about $31 million at the time.

Prosecutors have asked anyone who believes they were a victim of the Uranium hacks to contact Homeland Security Investigations.

Daily Debrief Newsletter

Start every day with the top news stories right now, plus original features, a podcast, videos and more.