Jay Clayton, U.S. Attorney for the Southern District of New York | Department of Justice
United States Attorney for the Southern District of New York, Jay Clayton, announced on Mar. 30 that Jonathan Spalletta, also known as “Cthulhon” and “Jspalletta,” has been indicted on charges of computer fraud and money laundering related to his alleged hacking of the decentralized cryptocurrency exchange Uranium Finance. Spalletta surrendered to authorities and was scheduled to appear before U.S. Magistrate Judge Ona T. Wang, with the case assigned to U.S. District Judge Jed S. Rakoff.
The case highlights ongoing concerns about security vulnerabilities in cryptocurrency platforms and their impact on investors who can suffer significant financial losses when such incidents occur.
According to the indictment, Uranium Finance allowed users to trade cryptocurrencies through liquidity pools. In April 2021, Spalletta allegedly carried out two separate hacks targeting Uranium’s smart contracts. The first hack occurred on April 8, resulting in approximately $1.4 million in stolen cryptocurrency by repeatedly exploiting a bug that allowed him unauthorized withdrawals from a rewards pool. Shortly after this incident, Spalletta reportedly told another individual: “I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway.” He later negotiated with Uranium to keep around $386,000 as part of what prosecutors describe as a sham “bug bounty.”
A second hack took place on April 28 across multiple liquidity pools at Uranium Finance and resulted in an additional theft valued at approximately $53.3 million—an event that forced the platform’s shutdown due to depleted funds.
Spalletta is accused of laundering these proceeds through complex transactions using services such as Tornado Cash before spending some funds on rare collectibles including Magic: The Gathering cards (notably purchasing a "Black Lotus" card for about $500,000), Pokémon cards (including one set worth roughly $750,000), antique Roman coins like an "Eid Mar Denarius," and even historic memorabilia such as fabric from the Wright brothers’ airplane flown by Neil Armstrong during the first moon landing.
Authorities seized cryptocurrency worth about $31 million from Spalletta in February 2025 pursuant to judicial warrants along with several collectible items during searches at his residence.
“As alleged, Jonathan Spalletta repeatedly hacked smart contracts to steal millions of dollars’ worth of other people’s money for himself, and destroyed a cryptocurrency exchange in the process,” said Clayton. “In describing his alleged ‘heist,’ Spalletta told another individual ‘Crypto is just fake internet money anyway.’ Stealing from a crypto exchange is stealing—the claim that ‘crypto is different’ does not change that. For the victims, there is nothing different about having your money taken. Spalletta cost real victims real losses of tens of millions of dollars, and now he’s under real arrest.”
HSI Acting Special Agent in Charge Kevin Murphy said: “This indictment demonstrates HSI’s commitment to protecting the integrity of financial systems and holding cybercriminals accountable, regardless of the complexity or novelty of their schemes.” Murphy added that HSI will continue efforts against those exploiting emerging technologies for personal gain.
Spalletta faces up to ten years imprisonment if convicted on computer fraud charges and up to twenty years for money laundering; sentencing will be determined by judicial discretion if he is found guilty.
