Federal prosecutors in Manhattan have charged a Maryland man with computer fraud and money laundering over a pair of 2021 hacks that drained more than $50 million from the decentralized cryptocurrency exchange Uranium Finance — money he allegedly laundered and then spent on rare trading cards, Pokémon sets and an ancient Roman coin.

The U.S. Attorney’s Office for the Southern District of New York unsealed the indictment on March 30, after the defendant, Jonathan Spalletta, surrendered. The case revives one of the larger unsolved decentralized-finance (“DeFi”) exploits of 2021 and lands it squarely in Manhattan’s federal court.

The defendant and the charges

Spalletta, 36, of Rockville, Md. — who allegedly used the online handles “Cthulhon” and “Jspalletta” — is charged with one count of computer fraud, which carries a maximum sentence of 10 years in prison, and one count of money laundering, which carries up to 20 years. The case is assigned to U.S. District Judge Jed S. Rakoff, with a trial date set for September 2026.

How the hacks allegedly worked

According to the indictment, Spalletta carried out two separate attacks on Uranium Finance in April 2021. The first, between April 6 and April 8, abused the protocol’s rewards mechanism to extract cryptocurrency worth roughly $1.4 million at the time.

The far larger second strike came on April 28, 2021, when a coding error in the exchange’s smart contract allowed an attacker to siphon approximately $53.3 million from 26 liquidity pools — the pooled deposits that let a decentralized exchange function without a traditional intermediary.

Prosecutors say Spalletta then laundered the proceeds through complex cryptocurrency transactions, including the mixing service Tornado Cash, which obscures the trail between deposits and withdrawals. He allegedly converted some of the haul into high-value physical collectibles, including a Black Lotus card from the game Magic: The Gathering, first-edition Pokémon sets and an ancient Roman coin — purchases that can themselves leave a paper trail investigators follow.

The seizure that preceded the charges

The indictment follows a significant earlier recovery. On Feb. 24, 2025 — more than a year before Spalletta was charged — law enforcement seized approximately $31 million in cryptocurrency tied to the Uranium hack. The appreciation of the underlying tokens between the 2021 theft and the 2025 seizure helps explain why the recovered sum approaches the originally stolen amount despite years of laundering activity.

Why the case is in Manhattan

The Southern District of New York has positioned itself as the leading federal venue for cryptocurrency prosecutions, drawing on jurisdiction over financial activity routed through New York and a specialized cyber and complex-fraud unit. The office secured the 15-year sentence of Terraform Labs founder Do Hyeong Kwon in December 2025 after his August 2025 guilty plea, among other high-profile crypto matters.

DeFi exploits like the one charged here pose a distinct enforcement challenge: the platforms are pseudonymous, code-driven and often have no central operator to subpoena, so cases turn heavily on blockchain forensics — tracing tainted funds across wallets and through mixers — and on the moments when laundered crypto touches the traceable physical economy.

The charges are allegations, and Spalletta is presumed innocent unless and until convicted.

Verification

Frequently Asked Questions

Who was charged and where?
Jonathan Spalletta, 36, of Rockville, Maryland, charged by the U.S. Attorney's Office for the Southern District of New York with one count of computer fraud and one count of money laundering. The indictment was unsealed March 30, 2026.
What is Uranium Finance?
A decentralized cryptocurrency exchange built on smart contracts. Prosecutors say Spalletta exploited a flaw in its code in April 2021 to drain its liquidity pools.
How much was stolen and recovered?
The larger April 28, 2021 attack siphoned roughly $53.3 million from 26 liquidity pools; an earlier exploit drained about $1.4 million. On Feb. 24, 2025, law enforcement seized about $31 million in cryptocurrency tied to the hack.
What penalties does he face?
Computer fraud carries up to 10 years and money laundering up to 20 years. Trial is scheduled for September 2026 before U.S. District Judge Jed S. Rakoff in Manhattan.