Cryptohack Roundup: Conviction in Uranium Finance Hack

Blockchain & Cryptocurrency , Cryptocurrency Fraud , Fraud Management & Cybercrime

Every week, ISMG rounds up cybersecurity incidents in digital assets. This week, a cybersecurity consultant convicted in a $54 million exploit case, a $30 million penalty in Fundsz fraud case, Near Intents halted services after $3.8 million hack, Abstract Blockchain will close, Velocity will reimburse hack victims, the United States withdrew two regulation proposals, a ZackXBT probe into North Korean laundering operation and crypto wallets linked to a ransomware gang.

See Also: Revolutionizing Cross-Border Transactions with Permissioned DeFi

Cybersecurity Consultant Convicted in $54M Crypto Hack

A U.S. federal jury convicted Maryland cybersecurity consultant Jonathan Spalletta of computer fraud and money laundering for stealing more than $54 million from cryptocurrency exchange Uranium Finance in two attacks in April 2021.

Spalletta exploited flaws in the exchange's smart contracts, programs that automatically execute cryptocurrency transactions, to withdraw funds he was not entitled to receive.

He stole approximately $1.4 million in the first attack and $53.3 million in the second, forcing Uranium Finance to shut down.

Spalletta concealed the stolen funds through multiple cryptocurrency transactions, including transfers through Tornado Cash, a mixer service designed to obscure transaction trails.

He spent some proceeds on rare Pokémon and Magic: The Gathering cards, antique Roman coins and a piece of the Wright brothers' airplane.

Authorities seized $31 million in cryptocurrency in February 2025.

Prosecutors said Spalletta faces maximum prison sentences of 10 years for computer fraud and 20 years for money laundering.

US Court Orders $30M Penalty in Fundsz Fraud Case

A federal court in Florida ordered two defendants to pay more than $30 million in penalties for their roles in a fraudulent investment scheme involving digital assets and precious metals, said the Commodity Futures Trading Commission.

The court found that Brian Early and Alisha Ann Kingrey, who served as board members and Telegram group moderators for Fundsz, misled investors potential profits, trading performance and investment risks.

They falsely claimed that Fundsz could trade investors' money using a specialized algorithm and allow withdrawals with interest.

After learning the CFTC investigation, the pair attempted to retract their profit claims and remove Fundsz's social media presence.

The court also approved settlements involving two other defendants, Rene Larralde and Juan Pablo Valcarce. Larralde died in 2023, while Valcarce received a permanent ban on having digital assets or precious metals traded on his behalf.

Near Intents Halts Services After $3.8M Exploit

Near Intents temporarily suspended services after a security breach reportedly drained approximately $3.8 million from the platform, which allows users to exchange cryptocurrencies across different blockchain networks.

The company attributed the incident to a flaw in the interaction between its deposit and withdrawal infrastructure and a smart contract, a program that automatically executes blockchain transactions.

Near Intents said it had fixed the vulnerability and would fully reimburse affected users. The team said it was working with law enforcement and blockchain investigators to trace the stolen assets and would publish a detailed incident report.

Abstract Blockchain to Shut Down in December

Abstract, a blockchain network built to make cryptocurrency applications more accessible to consumers, will shut down on Dec. 15 after struggling with slow growth, limited trading activity and weak institutional interest.

The ethereum-based network attracted more than 400,000 users and hosted over 144 applications, supported by partnerships with brands including Disney and Red Bull Racing. But Abstract said its consumer-focused business model was no longer financially sustainable.

Users must transfer their assets to other networks before the shutdown or risk losing access to their funds.

Igloo Inc., the company behind Pudgy Penguins, funded Abstract for 18 months, losing tens of millions of dollars, said CEO Luca Netz. The company will now focus on Pudgy Penguins and its PENGU token.

Netz said Igloo rejected plans to launch an Abstract token because it lacked confidence in sustainable demand.

Velocity Opens Claims for Victims of $295M Hack

Decentralized cryptocurrency exchange Velocity, formerly Drift, opened a compensation process for users affected by an April cyberattack that resulted in approximately $295 million in losses.

Affected users can claim one DFX recovery token for every dollar lost. They can exchange these tokens for USDT, a cryptocurrency tied to the U.S. dollar, sell them or hold them until more recovery funds become available.

Current payouts are limited, with users receiving approximately one cent for every dollar lost.

Velocity's recovery pool holds $3.11 million, with additional funding expected from platform revenue and commitments by Tether and strategic partners.

The Drift Foundation said investigators linked the attack to a North Korean hacking group. Approximately $286 million in stolen cryptocurrency remains in three attacker-controlled wallets, while another portion was moved through a service designed to obscure transactions.

Authorities have frozen approximately $9.2 million in stolen assets so far.

US Treasury Withdraws 2 Cryptocurrency Surveillance Proposals

The U.S. Department of the Treasury withdrew two proposed cryptocurrency regulations, citing concerns financial privacy and excessive reporting requirements.

The Financial Crimes Enforcement Network abandoned a 2023 proposal that would have required financial institutions to report transactions involving cryptocurrency mixers, services that obscure transaction details.

FinCEN said the proposal's broad definition of mixing could discourage legitimate activity and impose substantial reporting burdens. The agency acknowledged that mixers can protect financial privacy, although criminals use them to conceal stolen funds (see: US Sanctions, Seizes Sinbad Cryptomixer ).

FinCEN also withdrew a 2020 proposal requiring financial institutions to verify identities and maintain additional records for certain transactions involving self-hosted cryptocurrency wallets, which users control without intermediaries.

Investigator Infiltrates Network Laundering Funds for North Korea

Blockchain investigator ZachXBT said he infiltrated a Chinese criminal network responsible for laundering more than $1 billion in stolen cryptocurrency for North Korea's Lazarus Group.

The investigation followed the February 2025 hack of cryptocurrency exchange Bybit, which caused losses of approximately $1.5 billion.

Posing as a customer, ZachXBT transferred nearly $350,000 in cryptocurrency to conduct transactions with a suspected money launderer using the name "Jimmy Green."

He said their conversations and transaction records connected the network to stolen Bybit funds. ZachXBT said Jimmy disclosed details the group's operations in China and Hong Kong and described plans to move stolen assets between blockchain networks.

ZachXBT traced several transactions to known cryptocurrency thefts, including one group of wallets holding more than $12 million linked to Bybit. Cryptocurrency issuer Tether subsequently froze $442,000 associated with those wallets.

The pseudonymous investigator said he shared his findings with law enforcement.

Chainalysis Confirms Crypto Wallets in Ransomware Gang Leak

Blockchain analytics firm Chainalysis verified cryptocurrency addresses exposed in leaked internal chats allegedly belonging to Silent Ransom Group, a Russia-linked hacking operation that extorts U.S. law firms and financial institutions.

The leak, published on a ransomware website, contains nearly 5,700 messages spanning August 2025 to September 2026. The conversations reportedly reveal ransom payments, money laundering methods and the group's operating expenses.

Blockchain intelligence firm Crystal said the messages claimed approximately $207 million in payments from 27 firms, although that total is unverified.

Chainalysis independently traced several leaked wallets to millions in extortion proceeds, including one funded entirely by a victim payment exceeding $10 million.

The investigators also identified cryptocurrency transfers apparently used to pay people providing services to the group.

Silent Ransom Group typically steals confidential information by impersonating IT support staff and threatens to publish it unless victims pay.