$54M Crypto Hack Nets Maryland Man 30-Year Charge

Federal prosecutors say a Maryland man who stole more than $54 million from a crypto exchange blew a significant portion of the money on Pokémon cards, antique Roman coins, and a scrap of fabric from the Wright brothers’ plane.

A Hacker With An Unusual Shopping List

Jonathan Spalletta surrendered to authorities Monday after the US Attorney’s Office for the Southern District of New York unsealed an indictment against him. Agents who searched his home found the collectibles. The items were seized. Spalletta now faces up to 30 years in prison if convicted on all charges — one count of computer fraud and one count of money laundering.

The case centers on two separate attacks against Uranium Finance, a now-defunct crypto exchange that operated on the BNB blockchain. Both hacks happened in April 2021, just weeks apart, and together they wiped out tens of millions of dollars in user funds. The platform never recovered.

The first attack, on April 8, was relatively minor by crypto-crime standards. A bad actor exploited a smart contract flaw and walked away with $1.4 million. The two sides eventually reached a private agreement, and all but $386,000 was returned. Then, 20 days later, Spalletta allegedly came back for more.

The Second Strike Killed The Platform

The April 28 attack was on another level. According to prosecutors, Spalletta exploited a coding error in Uranium Finance’s withdrawal system, hitting 26 separate liquidity pools in a single sweep. He made off with $53.3 million in Bitcoin, Ether, and the platform’s own U92 token. The exchange shut down shortly after. Victims were left with little information and no recourse.

Uranium Finance had launched just days before the first hack, during the 2021 bull market. It was built as a fork of Uniswap, a well-known automated trading protocol. The platform never got a chance to grow. By the end of April, it was gone.

Federal investigators worked the case for years behind the scenes. In early 2025, authorities recovered $31 million in cryptocurrency tied to the hack but offered no public explanation at the time. Monday’s indictment filled in the details.

US Attorney Jay Clayton made clear his office views crypto theft the same as any other financial crime. “Stealing from a crypto exchange is stealing,” Clayton said. “For the victims, there is nothing different about having your money taken.” He added that Spalletta caused real losses for real people and is now under real arrest.

Spalletta appeared before US Magistrate Ona Wang on Monday to formally hear the charges. Data from the broader crypto industry puts the 2021 hack in context — bad actors stole an estimated $2.6 billion through various exploits that year alone. The biggest was a $610 million breach of the Poly Network, though the hacker in that case eventually returned the funds.

The Uranium Finance victims have waited nearly five years for answers. Monday’s indictment was a start.

Featured image from Unsplash, chart from TradingView