US authorities have unsealed an indictment charging Maryland resident Jonathan Spalletta with carrying out two separate hacks against Uranium Finance, a now-defunct decentralized finance platform that lost more than $54 million in April 2021. Spalletta surrendered to authorities after the indictment was announced by the US Attorney’s Office for the Southern District of New York.
Prosecutors say Spalletta exploited vulnerabilities in Uranium Finance’s smart contracts to withdraw funds beyond authorized limits, forcing the exchange to shut down. US Attorney Jay Clayton said, “Stealing from a crypto exchange is stealing—the claim that ‘crypto is different’ does not change that. For the victims, there is nothing different about having your money taken. Spalletta cost real victims real losses of tens of millions of dollars, and now he’s under real arrest.”
Uranium Finance, a BNB Chain fork of Uniswap, launched in April 2021. On April 8, 2021, a bad actor exploited a smart contract to withdraw about $1.4 million in rewards; a private deal later returned all but roughly $386,000. On April 28, 2021, a second exploit of withdrawal limits across 26 liquidity pools allowed an attacker to steal approximately $53.3 million in crypto, including Bitcoin (BTC), Ether (ETH) and the platform’s U92 tokens. The platform’s website closed after the second hack and victims have received few answers since.
Authorities allege the stolen funds were spent on collectibles, including Pokémon cards, antique Roman coins and a piece of fabric from the Wright brothers’ original airplane; such items were seized during a search of Spalletta’s residence. In February 2025, investigators seized about $31 million in cryptocurrency tied to the hack, though details were not released at the time.
Spalletta faces one count of computer fraud—punishable by up to 10 years—and one count of money laundering—punishable by up to 20 years. He was scheduled to be presented before US Magistrate Ona Wang to hear the charges.
The Uranium Finance thefts were part of a broader spike in crypto hacks in 2021, when bad actors stole an estimated $2.6 billion in hacks and exploits. The largest that year was a $610 million attack on cross-chain DeFi protocol Poly Network; that attacker later returned nearly all funds, describing the action as white-hat.