Jury Convicts Uranium Finance Hacker Who Spent Crypto Loot on Pokemon Cards

Jury Raps Spalletta connected Both Counts

Inner City Press reported Wednesday morning that a Manhattan national assemblage recovered Jonathan Spalletta blameworthy of machine fraud and wealth laundering successful the Uranium Finance case, closing the publication connected a proceedings packed with smart-contract bugs, millions successful crypto, and a buying database acceptable for a collector with wealth to burn.

The assemblage began deliberating Tuesday day and returned its verdict Wednesday, according to Inner City Press courtroom newsman Matthew Russell Lee. Afterward, prosecutors sought GPS monitoring for Spalletta, but U.S. District Judge Jed S. Rakoff declined to heap connected further conditions, citing Spalletta’s attendance successful court.

Sentencing has not been set. The charging papers transportation statutory maximums of 10 years for machine fraud and 20 years for wealth laundering, but those are ceilings, not a forecast of what Rakoff volition impose.

A Missing Zero Opens the Vault

The lawsuit stretches backmost to April 2021, erstwhile Uranium Finance, a BNB Chain decentralized concern (DeFi) automated marketplace maker, was deed twice. Prosecutors said Spalletta first exploited a rewards-distribution flaw connected April 8 and took astir $1.4 cardinal earlier returning astir $1 cardinal nether what authorities described arsenic a sham bug bounty.

A connection quoted successful the indictment didn’t precisely assistance matters:

“I did a crypto heist of $1.5MM a mates of weeks ago… There was a bug successful a astute contract, and I exploited it… Crypto is each fake net wealth anyway.”

Then came the large score. On April 28, a faulty mathematical check successful Uranium’s mentation 2.1 contracts efficaciously near a zero retired of the equation. Prosecutors said Spalletta exploited the flaw crossed 26 liquidity pools and made disconnected with astir $53.3 million, leaving Uranium without funds.

From Tornado Cash to Pokémon

The wealth way is wherever the yarn takes a unusual turn. Prosecutors said astir $26 cardinal moved done the ether mixing work Tornado Cash betwixt April 2021 and November 2023. Blockchain researcher ZachXBT later traced millions emerging from the mixer successful 100 ETH chunks and being converted and spent connected collectibles.

Onchain researcher ZachXBT discussing the lawsuit successful 2023.

The indictment says Spalletta bought a uncommon “Black Lotus” Magic: The Gathering paper for astir $500,000, 18 sealed Alpha Booster Magic packs for astir $1.51 million, and a first-edition Pokémon card basal acceptable for astir $750,000.

There was more. Purchases allegedly included a $257,500 first-edition Pokémon booster box, a astir $601,545 Roman Eid Mar coin commemorating Julius Caesar’s assassination and, for astir $137,500, cloth from the Wright brothers’ airplane that Neil Armstrong aboriginal carried to the moon. Federal agents seized astir $31 cardinal successful crypto successful February 2025, on with collectibles including the Black Lotus and Wright brothers fabric.

‘Whose Fingers Were connected the Keyboard?’

At trial, Spalletta’s defence came retired swinging connected attribution. Counsel argued prosecutors couldn’t beryllium “whose fingers were connected the keyboard,” that Spalletta hadn’t written Uranium’s faulty code, and that Tornado Cash itself was a privateness tool.

The authorities countered with blockchain tracing and Spalletta’s ain messages. In 1 quoted speech aft the archetypal incident, helium told a Uranium representative, “Get your codification audited adjacent time.”

The assemblage rejected the defence connected some counts. At property time, the adjacent enactment remained unwritten: nary sentencing day had been set, restitution and forfeiture questions remained open, and nary Justice Department condemnation merchandise had appeared.