Jonathan Spalletta exploited coding flaws in a decentralized exchange to steal more than $50 million, then left prosecutors a physical trail measured in rare trading cards, ancient coins, and moon-touched fabric.
A federal jury in Manhattan convicted Jonathan Spalletta, 36, of Rockville, Maryland, on one count of computer fraud and one count of money laundering after a six-day trial before U.S. District Judge Jed S. Rakoff. Prosecutors said he drained more than $50 million from the Uranium Finance cryptocurrency exchange.
He then used part of those proceeds to buy a $601,545 Roman coin, a $500,000 Magic: The Gathering card, and a $750,000 Pokémon base set.
Uranium Finance was a decentralized exchange, meaning it operated through self-executing programs called smart contracts rather than a central company. Those contracts managed liquidity pools, which are shared reserves of cryptocurrency that users deposit to enable trading on the platform.
How the Exploits Worked
Two attacks, twenty days apart, forced a crypto platform to shut down for good.
Spalletta, operating under the aliases “Cthulhon” and “Jspalletta,” first struck on April 8, 2021, manipulating a smart contract to make unauthorized withdrawals totaling approximately $1.4 million. Prosecutors said he then pressured Uranium Finance to let him keep roughly $386,000 of those funds as a so-called bug bounty in exchange for returning the rest.
Twenty days later, on April 28, 2021, prosecutors said he exploited a separate coding error affecting 26 liquidity pools. That second attack extracted approximately $53.3 million in cryptocurrency.
Uranium Finance shut down. It no longer had sufficient funds to operate.
From Blockchain to Black Lotus
Prosecutors said the collectible purchases converted digital proceeds into identifiable physical assets.
Authorities said Spalletta spent approximately $1.512 million on 18 sealed Alpha Booster packs from Magic: The Gathering. He also paid roughly $257,500 for a sealed first-edition Pokémon booster box.
A complete first-edition Pokémon base set cost approximately $750,000. A single Black Lotus card cost approximately $500,000.
The spending extended beyond trading cards. Prosecutors identified the purchase of a Wright brothers’ airplane fabric fragment, later carried to the Moon by Neil Armstrong, for approximately $137,500. An Eid Mar Denarius, an ancient Roman coin associated with the assassination of Julius Caesar, cost approximately $601,545.
In February 2025, authorities seized approximately $31 million in cryptocurrency from Spalletta. The identified collectible purchases account for roughly $3.76 million of the total alleged proceeds.
What Comes Next
The conviction carries sentencing exposure and broader implications for decentralized finance.
The computer fraud count carries a maximum sentence of 10 years in prison. The money laundering count carries a maximum of 20 years. Judge Rakoff will determine the actual sentence.
For developers building decentralized platforms, the case illustrates that coding vulnerabilities in smart contracts can become catastrophic liabilities. For prosecutors, the verdict confirms that converting cryptocurrency into physical assets, however rare or historically significant, does not erase a blockchain trail.
