Threat Intelligence
Maryland man convicted of stealing $53 million from Uranium crypto exchange
A Maryland man has been found guilty of hacking Uranium Finance, stealing over $53 million and causing the exchange to shut down. Authorities have recovered some funds and seized luxury collectibles.
Ross GrantUpdated 3 min read
The short version
A man from Maryland hacked a cryptocurrency exchange called Uranium Finance in 2021, stealing over $53 million. He found mistakes in the exchange's computer code and used them to take money that belonged to other users. The theft forced the exchange to shut down. Authorities have since recovered some of the money and luxury items he bought with it.
By the numbers
- $53.3 millionTotal stolen from Uranium FinanceBleepingComputer
- $31 millionCryptocurrency recovered by authoritiesBleepingComputer
- $1.5 millionSpent on Magic: The Gathering Alpha Booster cardsBleepingComputer
- $750,000Spent on first-edition Pokémon base setBleepingComputer
- 10 yearsMaximum prison sentence for computer fraudBleepingComputer
- 20 yearsMaximum prison sentence for money launderingBleepingComputer
What happened?
A Maryland man was found guilty of hacking Uranium Finance, a decentralised crypto exchange, twice in April 2021. He stole over $53 million by exploiting flaws in the exchange's code, forcing it to shut down. Authorities have recovered some funds and seized luxury collectibles bought with the proceeds.
Two hacks bring down Uranium Finance
In April 2021, Uranium Finance, a decentralised cryptocurrency exchange running on Binance's BNB Chain, was hit by two major attacks. According to BleepingComputer (opens in a new tab), Jonathan Spalletta, a 36-year-old from Maryland, exploited flaws in Uranium's smart contract code. He first drained $1.4 million by issuing zero-token withdrawal commands, tricking the system into paying him rewards he was not owed. After this, he pressured Uranium into labelling part of the stolen funds as a "bug bounty" to return the rest.
Three weeks later, Spalletta struck again. This time, he found another coding error in the exchange's transaction checks. The mistake allowed him to withdraw nearly 90% of Uranium's liquidity pool, about $53.3 million, while depositing almost nothing. The loss was so severe that Uranium Finance shut down immediately, citing a lack of funds.
How the stolen funds were laundered and spent
After the theft, Spalletta laundered the cryptocurrency through Tornado Cash, a service that mixes digital coins to make them harder to trace, and several decentralised exchanges. He then spent the proceeds on rare collectibles: 18 sealed packs of Alpha Booster Magic cards (about $1.5 million), a first-edition Pokémon base set ($750,000), a "Black Lotus" Magic: The Gathering card ($500,000), and an ancient Roman coin commemorating Julius Caesar's assassination (over $601,000), among other items.
Law enforcement seized these luxury items from Spalletta's home in February 2025. They also recovered around $31 million in cryptocurrency from wallets linked to him.
Investigation and conviction
Crypto fraud investigator ZachXBT first connected over 11,200 ETH (worth $25 million at the time) withdrawn from Tornado Cash to the Uranium hack in December 2023. Spalletta surrendered to authorities in March 2026 and was charged with computer fraud and money laundering. In October 2026, he was found guilty. He now faces up to 10 years in prison for computer fraud and up to 20 years for money laundering.
The impact on victims and the crypto industry
The collapse of Uranium Finance left many users out of pocket. U.S. Attorney Jamie McDonald said Spalletta's actions caused real people to lose real money and forced an entire platform to close. The case highlights ongoing risks in decentralised finance (DeFi), where coding errors in smart contracts can have devastating consequences. It also shows how criminals use mixing services to hide stolen cryptocurrency, making recovery difficult.
What this means for crypto users and exchanges
For ordinary users, this case is a reminder that even popular crypto platforms can be vulnerable to technical flaws. Unlike traditional banks, DeFi exchanges often lack insurance or government protection. For exchanges, it underlines the need for thorough code audits and rapid response to vulnerabilities. Law enforcement's ability to recover some funds and seize assets also shows that digital crimes can have real-world consequences.
What you should do
If you use DeFi platforms, check if they have been audited by independent experts and be cautious with large deposits. For those working in crypto security, this case is a lesson in the importance of secure smart contract development and monitoring for suspicious activity.
Claimed vs confirmed
- Confirmed
Jonathan Spalletta stole over $53 million from Uranium Finance by exploiting smart contract flaws.
Court documents and law enforcement statements confirm Spalletta's conviction for the theft.
- Confirmed
Spalletta laundered funds through Tornado Cash and bought rare collectibles.
Law enforcement seized collectibles and recovered cryptocurrency from wallets linked to Spalletta.
The impact
- Money
- The theft caused Uranium Finance to shut down, with over $53 million stolen. Authorities recovered about $31 million. In similar cases, crypto exchanges have faced legal action and possible regulatory fines.
- Reputation
- Uranium Finance's collapse damaged trust in the platform and highlighted risks in decentralised finance. The case received wide media coverage, increasing scrutiny of DeFi security.
- Customers
- Users lost access to their funds and the platform. There is no mention of compensation. Crypto users should be cautious with platforms that have not undergone thorough security audits.
Why it matters
This case shows that coding errors in cryptocurrency platforms can lead to huge losses for users. It also highlights the challenges of tracing stolen digital money and the need for strong security in decentralised finance.
How does it work?
The attacker exploited flaws in Uranium Finance's smart contract code. In the first attack, he used zero-token withdrawal commands to claim rewards he was not entitled to. In the second, a coding error in transaction verification allowed him to withdraw almost all assets from the exchange's liquidity pool while depositing almost nothing.
Key points
- A Maryland man stole over $53 million from Uranium Finance by exploiting code flaws.
- The theft forced the crypto exchange to shut down.
- Authorities recovered some funds and seized luxury collectibles bought with the stolen money.
- The case highlights the risks of coding errors in decentralised finance.
- Law enforcement can sometimes recover assets, even after laundering through crypto mixers.
Sources
BleepingComputer
Reference
SC Media
Reference
