A Maryland man has been arrested and charged with hacking the defunct decentralized finance platform Uranium Finance, leading to over $54 million in losses in 2021. Jonathan Spalletta is accused by the US Attorney’s Office for the Southern District of New York of executing two smart contract exploits that ultimately shut down the exchange. Authorities allege he spent stolen funds on collectibles, including Pokémon cards and antique Roman coins, and have seized $31 million in cryptocurrency tied to the case.
US authorities unsealed an indictment against Maryland resident Jonathan Spalletta, accusing him of hacking Uranium Finance. The US Attorney’s Office for the Southern District of New York stated Spalletta carried out two separate exploits against the platform in April 2021, causing over $54 million in losses.
Uranium Finance, a BNB Chain fork of Uniswap, launched in April 2021 but was forced to shutter after the attacks. In a statement, US Attorney Jay Clayton said, “Stealing from a crypto exchange is stealing—the claim that ‘crypto is different’ does not change that.” He added that Spalletta caused real victims real losses and is now under arrest.
The first hack occurred on April 8, 2021, resulting in a $1.4 million loss via a smart contract exploit. A private deal with the hacker saw most funds returned, leaving $386,000 unrecovered. A larger second exploit on April 28 stole $53.3 million from 26 liquidity pools by exploiting a withdrawal limit error.
Prosecutors allege the stolen funds were used to purchase collectibles, including Pokémon cards and antique Roman coins. These items were seized during a search of Spalletta’s residence. Authorities also seized $31 million in cryptocurrency tied to the hack in February of last year.
Spalletta faces one count of computer fraud, carrying a possible sentence of up to 10 years, and one count of money laundering, carrying a possible sentence of up to 20 years. He was presented before US Magistrate Ona Wang to formally hear the charges. It is estimated that bad actors stole more than $2.6 billion through hacks and exploits in 2021.
