Uranium Finance hacker convicted over DeFi exploits and laundering

A Manhattan federal jury has convicted Jonathan Spalletta, a cybersecurity consultant, of computer fraud and money laundering. The charges stem from two exploits that drained Uranium Finance, a decentralized finance exchange that collapsed after the attacks in April 2021.

The jury took roughly two hours to reach its verdict on October 7, 2026. For a six-day trial about smart contracts, liquidity pools and crypto laundering, that counts as a brisk afternoon.

Two attacks, one dead exchange

Prosecutors laid out a pair of exploits that hit Uranium Finance within weeks of each other. The first came on April 8, 2021.

In that attack, Spalletta abused a smart-contract function that tracked rewards, taking about $1.4 million.

The second attack, on April 28, did far more damage. It drained approximately $53.3 million from 26 liquidity pools.

Uranium Finance shut down after the attacks.

Spalletta went by the online handles “Cthulhon” and “Jspalletta.” US District Judge Jed S. Rakoff presided over the trial in Manhattan.

From Tornado Cash to Julius Caesar

Spalletta laundered a significant portion of the proceeds between 2021 and 2023. Roughly $26 million moved through Tornado Cash, a crypto mixing service designed to obscure where funds come from and where they go.

He also converted stolen crypto into high-end collectibles. The haul included a Black Lotus card from Magic: The Gathering, a Roman coin marking the assassination of Julius Caesar, and a fragment of fabric from a Wright brothers airplane that had been flown to the moon.

On February 24, 2025, law enforcement seized around $31 million in crypto linked to the theft. Authorities also recovered collectibles from Spalletta’s residence valued at more than $3 million.

The end of the code is law defense

Prosecutors argued that operating in crypto offers no legal defense for exploiting a platform, and that the usual rules on fraud and theft still apply. The jury agreed, and quickly.

Spalletta now faces a potential total of 30 years in prison. The computer fraud count carries a statutory maximum of 10 years, while the money laundering count carries a maximum of 20 years.

Sentencing is scheduled for February 16, 2027. Statutory maximums are ceilings, not predictions, and the final sentence will be up to Judge Rakoff.

What this means for DeFi

For DeFi users and builders, the most important detail may be the timeline. The exploits happened in April 2021, the seizure came in February 2025, and the conviction arrived in October 2026.

For users, a conviction does not undo a collapse. Uranium Finance still shut down, and recovered funds only arrived years later. Enforcement can punish an exploit, but it cannot rebuild a protocol after the fact.

The first Uranium Finance exploit targeted a rewards-tracking function. That is the kind of unglamorous code that often gets less scrutiny than headline features, and it is exactly where a determined attacker went looking.