Jonathan Spalletta, a Maryland resident, has been indicted on charges related to two separate cyberattacks against Uranium Finance, a decentralized finance platform that lost more than $54 million in 2021. The US Attorney’s Office for the Southern District of New York unsealed the indictment on Monday, the same day Spalletta surrendered to authorities. The charges include one count of computer fraud and one count of money laundering, carrying maximum sentences of 10 and 20 years respectively.
US Attorney Jay Clayton stated that Spalletta exploited smart contracts to steal millions from the platform, ultimately forcing it to shut down due to insufficient funds. Clayton emphasized that the nature of the asset does not change the character of the crime. He noted that the victims suffered real financial losses amounting to tens of millions of dollars.
Uranium Finance was a fork of automated market maker Uniswap, built on the BNB Chain, and launched in April 2021 during a period of strong market activity. The platform suffered its first attack on April 8, 2021, just days after going live, when a bad actor exploited a smart contract to withdraw far more cryptocurrency rewards than they were authorized to receive. That initial hack resulted in losses of approximately $1.4 million, though a private agreement between the platform and the attacker led to the return of all but $386,000 of the stolen funds.
A second, significantly larger attack followed on April 28, 2021, when a flaw in the Uranium smart contract governing withdrawal limits was exploited across 26 separate liquidity pools. The attacker made off with $53.3 million in cryptocurrency, including Bitcoin, Ether, and the platform’s native token, U92. The platform’s website went offline following this second breach, leaving victims with little information or recourse.
Prosecutors allege that Spalletta used a portion of the stolen funds to purchase collectibles, including Pokémon cards, antique Roman coins, and a piece of fabric from the Wright brothers’ original airplane. These items were recovered during a search of his residence. In February of the prior year, authorities had separately seized $31 million in cryptocurrency connected to the hack, though no details were disclosed at that time.
Spalletta was scheduled to appear before US Magistrate Ona Wang on Monday to formally hear the charges against him. The case highlights ongoing efforts by federal prosecutors to pursue individuals responsible for large-scale cryptocurrency thefts, even years after the incidents occurred.
The 2021 hacks on Uranium Finance were part of a broader wave of crypto-related theft that year. Estimates suggest bad actors stole more than $2.6 billion through various hacks and exploits during that period, with the largest single incident being a $610 million attack on cross-chain protocol Poly Network, whose attacker later returned the funds and was described by the team as a white-hat actor.
Originally reported by CoinTelegraph.
