US Cybersecurity Consultant Arrested for Stealing Over $50 Million from Crypto Exchange

A 36-year-old US cybersecurity consultant was convicted of stealing over $50 million in cryptocurrency from the Uranium Finance exchange through exploitation of smart contract vulnerabilities. The stolen funds were used to purchase rare collectible cards, including Pokemon and Magic: The Gathering cards, as well as historical artifacts.

Case Overview

In October 2026, Jonathan Spalletta, a 36-year-old US cybersecurity consultant, was convicted of computer fraud and money laundering. In April 2021, Spalletta executed two unauthorized access attacks on Uranium Finance, a decentralized cryptocurrency exchange, and stole over $50 million in digital assets.

Attack Methods

First Attack (April 8, 2021)

Spalletta exploited a vulnerability in Uranium Finance's smart contract—a self-executing program on the blockchain. By executing deceptive repetitive transactions, he manipulated the system to receive approximately $1.4 million in rewards, far exceeding his legitimate entitlement. He subsequently claimed a security bug bounty of approximately $386,000, though prosecutors contend this claim was fraudulent.

Second Attack (April 28, 2021)

The second attack targeted a flaw in the contract's mechanism for calculating withdrawals from multiple liquidity pools simultaneously. This attack yielded approximately $53.3 million. Following this breach, Uranium Finance lost its funds and ceased operations.

Use of Stolen Funds

The stolen cryptocurrency was converted and spent on rare collectibles:

Pokemon card base set (1st edition): ~$750,000
Pokemon card booster box (1st edition, sealed): ~$257,500
Magic: The Gathering "Black Lotus" card: ~$500,000
Magic: The Gathering "Alpha Booster" packages (18 sealed): ~$1.5 million
Historical Roman coin (Eid Mar denarius): ~$601,545
Fabric from Wright brothers' aircraft (carried to the moon by Neil Armstrong): ~$137,500

Money Laundering Activities

Between April 2021 and November 2023, approximately $26 million in stolen cryptocurrency was transferred through multiple transactions to obscure the fund flows. Approximately $26 million was channeled through Tornado Cash (a cryptocurrency mixer) and various blockchains to hide the origins of the funds.

Investigation and Arrest

On February 24, 2025, authorities executed a search warrant at Spalletta's residence and seized the Black Lotus card, historical artifacts, and cryptocurrency assets worth approximately $31 million at that time.

Sentencing

Spalletta was convicted on:

Computer fraud: up to 10 years imprisonment
Money laundering: up to 20 years imprisonment

Prevention and Risk Awareness

Cryptocurrency exchange users should be aware of the following:

Smart Contract Security Risks

Verify whether emerging exchanges have undergone external security audits
Check if audit reports are publicly available
Research the project's technical credibility before depositing large amounts

Fund Management

Avoid concentrating large amounts on a single exchange
Diversify holdings across multiple platforms
Use hardware wallets (offline storage) whenever possible
Never leave significant holdings on exchanges long-term

Detecting Fraud Schemes

Be cautious of claims offering bug bounties or compensation
Verify the legitimacy of any vulnerability disclosure program
Avoid unsolicited offers from exchange operators

Reporting Resources

If you experience cybercrime victimization or have security concerns:

FBI (United States): ic3.gov
Local law enforcement cybercrime divisions
Your cryptocurrency exchange's official support channels