Uranium Finance hacker faces 30 years in prison following the indictment of Jonathan Spalletta, 36, by the U.S. Attorney’s Office for the Southern District of New York. Spalletta surrendered to authorities on March 30, 2026, on charges of computer fraud and money laundering in connection with the 2021 exploits of the now-defunct decentralized finance (DeFi) platform. He faces a maximum sentence of 10 years for computer fraud and 20 years for money laundering.
Uranium Finance, an automated market maker (AMM) operating on what was then Binance Smart Chain (now BNB Chain), suffered two significant exploits in April 2021. These attacks led to total losses exceeding $53 million, ultimately forcing the Uniswap fork to cease operations after the second, more devastating incident.
The Dual Exploits of Uranium Finance
The first hack, occurring between April 6 and 8, 2021, involved the theft of approximately $1.4 million. This initial breach exploited a flaw within the protocol’s reward distribution system. While roughly $1 million of these funds were eventually returned after negotiations, a sum of $385,500 was retained by the attacker and subsequently laundered. This early incident served as a precursor to a much larger security failure.
The second, and far more substantial, exploit took place on April 28, 2021. This attack resulted in the theft of an astonishing $52 million. The vulnerability stemmed from a single-character code error in Uranium Finance’s trading logic, which effectively created a faulty vault mechanism. This critical flaw led to miscalculations in balances, allowing the attacker to withdraw significantly more tokens than they were permitted. The calculation error was specifically identified within the swap function of version 2 of the project’s smart contracts. The stolen assets comprised a diverse portfolio of cryptocurrencies, including Bitcoin (BTC), Ethereum (ETH), Polkadot (DOT), Cardano (ADA), Tether USD (USDT), and Uranium’s native token (u92).
Tracing the Digital Footprints and Seizures
Prosecutors allege that Jonathan Spalletta utilized the stolen funds to acquire a range of rare collectibles. These purchases reportedly included highly sought-after Pokémon cards, antique Roman coins, and an extraordinary piece of fabric from the Wright brothers’ plane, which was famously carried to the moon by Neil Armstrong during the Apollo 11 mission. Blockchain intelligence firm TRM Labs played a crucial role in assisting law enforcement, meticulously tracing the movement of the illicit assets across multiple blockchains. The funds were deliberately funneled through sophisticated crypto mixers like Tornado Cash and various decentralized exchanges in an attempt to obscure their origin. Intriguingly, some of the funds remained dormant for nearly four years before being moved again in early 2024.
“The meticulous tracing of stolen crypto assets across multiple blockchains and through mixers highlights the growing sophistication of law enforcement in combating DeFi crime.”
In a significant breakthrough, U.S. authorities, including the U.S. Attorney’s Office for the Southern District of New York (SDNY) and Homeland Security Investigations (HSI) San Diego, successfully seized approximately $31 million of the stolen cryptocurrency in February 2025. The SDNY has since issued a public appeal, urging victims of the hack to contact them directly for potential restitution. This seizure represents a substantial recovery and a testament to the ongoing efforts to hold perpetrators of crypto fraud accountable. For more insights into regulatory actions in the digital asset space, explore our related Crypto news.
Uranium Finance Hacker Faces 30 Years
The indictment and surrender of Jonathan Spalletta underscore the increasing scrutiny and legal ramifications for individuals involved in cryptocurrency fraud. The Uranium Finance hacker faces 30 years, serving as a stark warning to those who believe they can operate with impunity in the decentralized finance landscape. This case highlights the persistent challenges within DeFi security but also demonstrates the growing capabilities of law enforcement and blockchain intelligence firms in tracking and recovering stolen digital assets.
