A cryptocurrency hack allegedly worth more than $50 million began with vulnerable DeFi smart contracts and ended with some of the world’s most coveted collectibles — including rare Pokémon cards, a $500,000 Black Lotus and artifacts tied to Julius Caesar and the Wright brothers.

Now, more than five years after the alleged Uranium Finance exploits, Jonathan Spalletta is facing a federal criminal case over what prosecutors say was a sprawling effort to steal, move and spend millions of dollars in cryptocurrency. The allegations have not been proven in court.

From DeFi exploits to a $55M crypto trail

According to a U.S. Department of Justice indictment unsealed on March 30, 2026, prosecutors allege that Spalletta exploited vulnerabilities in Uranium Finance, a decentralized exchange that relied on liquidity pools, in two separate attacks in April 2021.

The first alleged exploit came on April 8, when prosecutors say Spalletta used a deceptive sequence of smart-contract transactions to withdraw rewards tokens far beyond what he was entitled to receive. The alleged attack extracted approximately $1.4 million in cryptocurrency, with prosecutors claiming that the transactions were repeated until nearly all of the rewards tokens in the pool had been drained.

Just 20 days later, prosecutors allege that Spalletta exploited another vulnerability, this time affecting withdrawals across 26 Uranium liquidity pools. The second attack allegedly allowed him to steal approximately $53.3 million in cryptocurrency, leaving Uranium without sufficient funds to continue operating.

The government describes the case as involving more than $50 million in alleged theft rather than establishing a single definitive combined figure. Spalletta surrendered after the indictment was unsealed and has denied the charges through his plea.

But the case did not end when the crypto allegedly left Uranium's pools. According to prosecutors, the money began a journey across wallets and blockchains that would eventually take it far beyond the digital-asset ecosystem.

The alleged stolen crypto trail led to Pokémon cards

The indictment alleges that Spalletta moved the cryptocurrency through a complex series of transactions involving multiple wallets and blockchains, including the privacy-focused crypto mixer Tornado Cash.

What makes the case unusual is where prosecutors say some of that money eventually went.

Rather than remaining as cryptocurrency, the alleged proceeds were used to acquire highly valuable physical collectibles. Among the purchases identified by the DOJ was a Black Lotus Magic: The Gathering card for approximately $500,000, along with 18 sealed Alpha booster packs worth about $1.51 million.

The alleged spending trail also reached the Pokémon market. Prosecutors say the funds were used to purchase a sealed first-edition Pokémon booster box valued at approximately $257,500 and a complete first-edition Pokémon base set worth around $750,000.

The purchases allegedly extended well beyond trading cards. The indictment identifies a piece of fabric from the Wright brothers' original airplane, which was later taken to the moon by astronaut Neil Armstrong, purchased for approximately $137,500.

Another alleged purchase was an Eid Mar Denarius, a rare Roman coin commemorating the assassination of Julius Caesar, for approximately $601,545.

That transformation is what makes the case particularly notable. Prosecutors are not simply alleging that stolen crypto remained hidden inside a series of anonymous-looking blockchain addresses. Their case describes an alleged trail from smart-contract exploits to wallets and blockchain transactions, and eventually to physical objects that could be identified, purchased and potentially seized.

Photos of the Black Lotus card, the historic fabric and certain coins were associated with property seized from Spalletta's residence under a judicially authorized search warrant, according to the DOJ.

The DOJ's announcement does not establish that a specific $26 million amount passed through Tornado Cash, although that figure has appeared in supplementary reporting. That distinction matters because the indictment and later reporting do not necessarily establish the same level of transaction detail.

Five years later, the crypto trail reaches federal court

The alleged attacks occurred in April 2021, but the case continued developing for years. Law enforcement seized cryptocurrency worth approximately $31 million on Feb. 24, 2025, under a judicially authorized seizure warrant, before the indictment was unsealed in March 2026.

Spalletta surrendered after the indictment became public and was scheduled to appear before U.S. Magistrate Judge Ona T. Wang. The case has since moved from the blockchain to the courtroom, where prosecutors must prove their allegations rather than simply demonstrate that suspicious transactions occurred.

That distinction is critical in a case built around blockchain tracing. A transaction can remain visible on a public ledger long after it takes place, but identifying the person behind an address and proving that the person controlled the funds or intentionally committed a crime can require evidence far beyond the blockchain itself.

The alleged collectibles therefore take on a significance beyond their price tags. Purchase records, counterparties, photographs, seized property and blockchain transactions can potentially provide investigators with different pieces of the same evidentiary chain.

The case illustrates one of the central challenges of crypto enforcement: moving stolen digital assets may be fast, but turning those assets into something tangible can create an entirely different trail.

For the alleged Uranium Finance attacker, prosecutors say that trail ran from vulnerable smart contracts and millions of dollars in cryptocurrency to Tornado Cash, Pokémon cards, Magic: The Gathering collectibles and historic artifacts.

More than five years after the alleged exploits, that trail has now reached a federal courtroom — where the government will have to prove that the collector at the end of it was also the person responsible for the crypto theft at the beginning.