Jury Convicts Uranium Finance Hacker Who Spent Crypto Loot on Pokemon Cards

Inner City Press reported Wednesday morning that a Manhattan federal jury found Jonathan Spalletta guilty of computer fraud and money laundering in the Uranium Finance case, closing the book on a trial packed with smart-contract bugs, millions in crypto, and a shopping list fit for a collector with money to burn.

The jury began deliberating Tuesday afternoon and returned its verdict Wednesday, according to Inner City Press courtroom reporter Matthew Russell Lee. Afterward, prosecutors sought GPS monitoring for Spalletta, but U.S. District Judge Jed S. Rakoff declined to pile on additional conditions, citing Spalletta’s attendance in court.

Sentencing has not been set. The charging papers carry statutory maximums of 10 years for computer fraud and 20 years for money laundering, but those are ceilings, not a forecast of what Rakoff will impose.

Know when your coins move

A Missing Zero Opens the Vault

The case stretches back to April 2021, when Uranium Finance, a BNB Chain decentralized finance (DeFi) automated market maker, was hit twice. Prosecutors said Spalletta first exploited a rewards-distribution flaw on April 8 and took $1.4 million before returning roughly $1 million under what authorities described as a sham bug bounty.

A message quoted in the indictment didn’t exactly help matters:

“I did a crypto heist of $1.5MM a couple of weeks ago… There was a bug in a smart contract, and I exploited it… Crypto is all fake internet money anyway.”

“I did a crypto heist of $1.5MM a couple of weeks ago… There was a bug in a smart contract, and I exploited it… Crypto is all fake internet money anyway.”

Then came the big score. On April 28, a faulty mathematical check in Uranium’s version 2.1 contracts effectively left a zero out of the equation. Prosecutors said Spalletta exploited the flaw across 26 liquidity pools and made off with $53.3 million, leaving Uranium without funds.

From Tornado Cash to Pokémon

The money trail is where the yarn takes a strange turn. Prosecutors said $26 million moved through the ether mixing service Tornado Cash between April 2021 and November 2023. Blockchain investigator ZachXBT later traced millions emerging from the mixer in 100 ETH chunks and being converted and spent on collectibles.

The indictment says Spalletta bought a rare “Black Lotus” Magic: The Gathering card for $500,000, 18 sealed Alpha Booster Magic packs for roughly $1.51 million, and a first-edition Pokémon card base set for $750,000.

There was more. Purchases allegedly included a $257,500 first-edition Pokémon booster box, a roughly $601,545 Roman Eid Mar coin commemorating Julius Caesar’s assassination and, for $137,500, fabric from the Wright brothers’ airplane that Neil Armstrong later carried to the moon. Federal agents seized $31 million in crypto in February 2025, along with collectibles including the Black Lotus and Wright brothers fabric.

‘Whose Fingers Were on the Keyboard?’

At trial, Spalletta’s defense came out swinging on attribution. Counsel argued prosecutors couldn’t prove “whose fingers were on the keyboard,” that Spalletta hadn’t written Uranium’s faulty code, and that Tornado Cash itself was a privacy tool.

The government countered with blockchain tracing and Spalletta’s own messages. In one quoted exchange after the first incident, he told a Uranium representative, “Get your code audited time.”

The jury rejected the defense on both counts. At press time, the act remained unwritten: no sentencing date had been set, restitution and forfeiture questions remained open, and no Justice Department conviction release had appeared.