In short
- US authorities have accused Jonathan Spalletta of running Uranium Finance, siphoning off tens of millions of dollars from the company that led to its collapse.
- Prosecutors say he allegedly took advantage of smart contract flaws, later funneling money through mixers and purchasing valuable collectibles.
- Last year, approximately $31 million in cryptocurrency was seized in connection with the case.
An alleged crypto hacker who once described digital assets as “fake internet money” is now in US custody, accused of carrying out a $53 million exploit that helped bring down a decentralized exchange.
US authorities announced on Monday indictment Jonathan Spalletta, also known as “Cthulhon” and “Jspalletta,” is charged with computer fraud and money laundering in connection with two 2021 attacks on Uranium Finance, a decentralized exchange.
Spalletta surrendered to authorities on Monday after the charges, and now faces a maximum of 10 years for computer fraud and 20 years for money laundering.
“Stealing from a crypto exchange is stealing – claiming that ‘crypto is different’ doesn’t change that.” U.S. Attorney Jay Clayton said in a statement.
The case fits into a broader effort to crack down on DeFi exploits that combine technical loopholes with misuse of funds.
“The idea that ‘code is law’ is increasingly being tested in court,” said Angela Ang, head of policy and strategic partnerships for Asia Pacific at TRM Labs. Declutter.
“Exploiting the vulnerabilities in smart contracts may be technically possible, but that does not mean that courts will consider it legally permissible – especially if it involves money laundering and concealment,” she added.
The indictment alleges that Spalletta carried out an initial attack on April 8, 2021, using a reward tracking bug in Uranium’s smart contracts to repeatedly drain a liquidity pool of approximately $1.4 million.
About two weeks later, he wrote to another individual: “I pulled off a $1.5 million crypto heist… There was a bug in a smart contract and I took advantage of it… Crypto is all fake internet money anyway.”
Authorities say he later returned most of the stolen money after negotiations with the platform, but kept about $386,000 under what prosecutors described as a sham bug bounty scheme.
On April 28, he allegedly exploited another flaw in 26 liquidity pools, obtaining approximately $53.3 million worth of crypto coins, leaving Uranium Finance unable to continue operating.
Between April 2021 and November 2023, Spalletta is said to have transferred approximately $26 million Tornado moneymove money among several blockchains And purses to obscure their origins.
Onchain sleuth ZachXBT had previously traced the money laundering trail in a December 2023 report, identifying how stolen ETH was extracted from the mixer and routed through brokers to purchase valuable collectibles.
According to the indictment, the collectibles include rare Magic and Pokémon cards, a Julius Caesar-era coin and a Wright brothers artifact that was later carried to the moon by Neil Armstrong.
Law enforcement also last February has seized crypto worth approximately $31 million which authorities say was related to the alleged scheme.
Asked whether stricter audits or insurance could have prevented the platform’s collapse, Ang said that “stronger audit and insurance mechanisms can reduce the likelihood and impact of exploits, but they are not a panacea.”
Organizations need “layered defenses,” including “regular security audits, secure coding practices, multi-signature controls and a strong security culture, rather than relying on a single security,” she added.
Daily debriefing Newsletter
Start every day with today’s top news stories, plus original articles, a podcast, videos and more.