US authorities have charged Jonathan Spalletta, 36, with orchestrating a massive cryptocurrency theft that drained more than $53 million from the Uranium Finance decentralized exchange.
According to an unsealed indictment, Spaletta aka “Cthulhon” and “Jspalletta,” carried out two separate attacks against Uranium Finance in April 2021. In the first breach on April 8, he exploited a flaw in the platform’s smart contract code, manipulating a variable to trigger unauthorized withdrawals and siphon approximately $1.4 million. Prosecutors say he later pressured the company into labeling nearly $386,000 of the stolen funds as a “bug bounty” in exchange for returning part of the assets.
Three weeks later, on April 28, Spalletta allegedly executed a second attack where he exploited a single-character coding error that altered transaction verification parameters, allowing him to withdraw nearly 90% of assets across 26 liquidity pools while depositing virtually nothing. The attack netted approximately $53.3 million and forced Uranium Finance to shut down.
Authorities say Spalletta laundered the stolen funds through decentralized platforms, including the cryptocurrency mixer Tornado Cash. He allegedly used the proceeds to purchase high-value collectibles, including a rare “Black Lotus” card from Magic: The Gathering, sealed Alpha booster packs, a first-edition Pokémon base set, and an ancient Roman coin commemorating the assassination of Julius Caesar.
In February 2025, law enforcement agents seized the collectibles from his residence and recovered approximately $31 million in cryptocurrency linked to his wallets.
Spalletta now faces up to 10 years in prison on a computer fraud charge and up to 20 years if convicted of money laundering.