Crypto Hacker Faces Trial Over Alleged $54 Million Uranium Finance Attack And High-Value Collectibles Purchases

A DeFi exploit allegedly worth more than $50 million has resurfaced years later through an unusual trail of luxury collectibles, including rare Pokémon and Magic: The Gathering cards, a historic Roman coin and material linked to the Wright brothers’ aircraft.

US prosecutors allege Jonathan Spalletta exploited Uranium Finance twice in April 2021, moved the cryptocurrency through multiple wallets and blockchains including Tornado Cash, and later used some of the proceeds to buy high-value collectibles.

Two Uranium Finance Exploits Allegedly Drained Millions

Uranium Finance operated as a decentralised cryptocurrency exchange where users could deposit assets into liquidity pools and exchange tokens.

Prosecutors allege Spalletta exploited weaknesses in the platform’s smart contracts in two separate attacks in April 2021.

The first incident took place on 8 April, when he allegedly used a deceptive series of smart-contract transactions to receive more rewards tokens than the system allowed.

The indictment says the process was repeated until nearly all of the rewards tokens in the relevant pool had been drained, with the cryptocurrency valued at approximately $1.4 million at the time.

A second exploit followed on 28 April and involved a separate flaw affecting withdrawals from 26 Uranium liquidity pools.

Prosecutors allege Spalletta manipulated the withdrawal mechanism and extracted cryptocurrency worth more than $53.3 million.

Uranium Finance subsequently shut down, with prosecutors saying the platform no longer had enough funds to continue operating.

The figures come from the US Department of Justice’s allegations and concern two separate incidents.

How Did The Crypto Reach Collectibles?

The alleged trail did not end with cryptocurrency sitting in wallets.

According to the indictment, the assets were moved through a complex network of transactions involving multiple wallets and blockchains, including Tornado Cash.

The DOJ has not provided a complete transaction-by-transaction account in its announcement, and a reported figure of approximately $26 million passing through Tornado Cash is not established by the indictment announcement itself.

Prosecutors also allege that some of the cryptocurrency was eventually used to purchase rare collectibles, giving investigators evidence outside the blockchain to examine alongside the digital transaction trail.

Among the items were a Black Lotus Magic: The Gathering card bought for approximately $500,000 and 18 sealed Alpha booster packs valued at about $1.51 million.

The alleged purchases also included a sealed first-edition Pokémon booster box for approximately $257,500 and a complete first-edition Pokémon base set for about $750,000.

Rare Cards And Historic Objects Become Part Of The Case

The alleged spending went beyond trading cards.

Prosecutors say Spalletta purchased a Roman Eid Mar Denarius commemorating Julius Caesar’s assassination for approximately.

Another purchase was a piece of fabric from the Wright brothers’ original aircraft, which was later taken to the Moon by astronaut Neil Armstrong, for approximately $137,500.

Authorities say more than $3 million worth of rare Magic: The Gathering and Pokémon cards were later seized from Spalletta’s Rockville home.

Photographs of the Black Lotus card, the aircraft fabric and certain coins were also associated with items seized during a judicially authorised search.

Separately, law enforcement seized approximately $31 million in cryptocurrency on 24 February 2025 under a judicially authorised seizure warrant.

Why The 2021 Exploits Returned Years Later

The alleged hacks occurred in 2021, but the case developed over several years before Spalletta surrendered following the unsealing of the indictment on 30 March 2026.

He was due to appear before US Magistrate Judge Ona T. Wang in the Southern District of New York.

The case, US v Spalletta, 26-cr-118, accuses him of exploiting Uranium Finance and laundering the resulting cryptocurrency.

Federal prosecutor Shaun Werbelow told jurors that Spalletta "orchestrated a plan to destroy a whole cryptocurrency platform, to steal $50 million and then launder the money he stole."

The prosecution alleges that the first attack involved Uranium’s rewards system, while the second targeted the amount users could withdraw from its liquidity pools.

Spalletta Says He Did Not Hack Uranium Finance

The defence disputes the prosecution’s interpretation of the transactions.

Defence lawyer Shrey Sharma acknowledged that Spalletta interacted with Uranium Finance but argued that he did not hack the platform.

Sharma said Spalletta used publicly available functions built into Uranium’s smart contracts and did not use spoofed credentials or malicious code to bypass access controls.

He also challenged the link between the alleged Uranium proceeds and the later purchases, saying,

"There is no proof that 'the cryptocurrency from Uranium Finance is the same cryptocurrency that was used to make these purchases.'"

The defence position puts the focus on whether exploiting publicly accessible smart-contract functions amounted to hacking and whether prosecutors can establish a direct financial connection between the stolen assets and the collectibles.

The charges against Spalletta remain allegations, and a conviction has not been established by the indictment or the prosecution’s statements.