United States Attorney for the Southern District of New York, Jay Clayton, and Kevin Murphy, Acting Special Agent in Charge of Homeland Security Investigations ("HSI") San Diego, announced the unsealing of an Indictment charging JONATHAN SPALLETTA, a/k/a "Cthulhon," a/k/a "Jspalletta," with computer fraud and money laundering in connection with his hacks of the decentralized cryptocurrency exchange Uranium Finance ("Uranium"). SPALLETTA surrendered today and will be presented this afternoon before U.S. Magistrate Judge Ona T. Wang. The case is assigned to U.S. District Judge Jed S. Rakoff.

"As alleged, Jonathan Spalletta repeatedly hacked smart contracts to steal millions of dollars' worth of other people's money for himself, and destroyed a cryptocurrency exchange in the process," said U.S. Attorney Jay Clayton. "In describing his alleged 'heist,' Spalletta told another individual 'Crypto is just fake internet money anyway.' Stealing from a crypto exchange is stealing-the claim that 'crypto is different' does not change that. For the victims, there is nothing different about having your money taken. Spalletta cost real victims real losses of tens of millions of dollars, and now he's under real arrest."

"This indictment demonstrates HSI's commitment to protecting the integrity of financial systems and holding cybercriminals accountable, regardless of the complexity or novelty of their schemes," said HSI Acting Special Agent in Charge Kevin Murphy. "HSI will continue to aggressively pursue those who exploit vulnerabilities in emerging technologies for personal gain and ensure that justice is served for victims of these crimes."

As alleged in the Indictment:[1]

Uranium was a decentralized cryptocurrency exchange that allowed users to deposit and exchange different kinds of cryptocurrencies via liquidity pools. In April 2021, SPALLETTA committed two separate hacks of Uranium.

In the first hack, on April 8, 2021, SPALLETTA engaged in a deceptive series of transactions with Uranium's smart contract that SPALLETTA used to withdraw far more "rewards" in cryptocurrency than he was authorized to receive. He repeated those transactions over and over until he had drained the liquidity pool of nearly all its rewards tokens. In total, SPALLETTA successfully extracted cryptocurrency worth approximately $1.4 million in the first hack. Approximately two weeks after he fraudulently obtained the funds, SPALLETTA told another individual in writing, "I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway." SPALLETTA subsequently extorted Uranium into agreeing to allow him to keep approximately $386,000 of the money he stole as a sham "bug bounty" to help him evade prosecution in exchange for return of the remainder of the stolen money to Uranium.

In the second hack, on April 28, 2021, SPALLETTA exploited an error in the Uranium smart contract that governed how much cryptocurrency he could withdraw in a liquidity pool on Uranium. SPALLETTA exploited that issue across 26 separate Uranium liquidity pools, fraudulently obtaining approximately $53.3 million in cryptocurrency and causing Uranium to shut down due to lack of funds.

SPALLETTA then laundered the funds he had fraudulently obtained from Uranium through a complex series of cryptocurrency transactions, including by using the cryptocurrency mixer Tornado Cash.

After laundering the funds, SPALLETTA used the money he had fraudulently obtained to purchase personal collectable items, including but not limited to (i) rare cards for the trading card game Magic: The Gathering ("Magic Cards"); (ii) rare cards for the trading card game Pokémon (the "Pokémon Cards"); and (iii) antique Roman coins (the "Antique Coins"), among other items. In particular, SPALLETTA used the fraudulently obtained funds to purchase: (i) a "Black Lotus" Magic Card for approximately $500,000; (ii) 18 packs of sealed "Alpha Booster" Magic Cards for approximately $1,512,500; (iii) one sealed box of first edition "Booster" Pokémon Cards for approximately $257,500; (iv) one first edition complete base set of Pokémon Cards for approximately $750,000; (v) a piece of fabric from the original Wright brothers' airplane that was subsequently transported to the surface of the moon by astronaut Neil Armstrong on the first moon landing, for approximately $137,500; (vi) one "Eid Mar Denarius," an Antique Coin commemorating the assassination of Julius Caesar, for approximately $601,545.

Photographs of the Black Lotus Magic Card, the piece of fabric from the original Wright brothers' airplane that was subsequently transported to the surface of the moon by astronaut Neil Armstrong, and certain of the Antique Coins, all of which were seized from the residence of SPALLETTA pursuant to a judicially-authorized search warrant, are below.

In addition, on February 24, 2025, law enforcement seized pursuant to a judicially-authorized seizure warrant cryptocurrency worth approximately $31 million at the time of seizure that SPALLETTA had fraudulently obtained from Uranium.

If you believe you have been a victim of the Uranium hack, please contact [email protected].

* * *

SPALLETTA, 36, of Rockville, Maryland, is charged with one count of computer fraud, which carries a maximum sentence of 10 years in prison; and one count of money laundering, which carries a maximum sentence of 20 years in prison.

The maximum potential sentences in this case are prescribed by Congress and provided here for informational purposes only, as any sentencing of the defendant will be determined by a judge.

Mr. Clayton praised the outstanding work of HSI.

The case is being prosecuted by the Office's Complex Frauds and Cybercrime Unit. Assistant U.S. Attorneys Kevin Mead and William C. Kinder are in charge of the prosecution.

The charges contained in the Indictment are merely accusations, and the defendant is presumed innocent unless and until proven guilty.