Cybersecurity consultant found guilty of stealing $55M in crypto from Uranium Finance

A Maryland cybersecurity consultant has been found guilty of stealing nearly $55 million in crypto, according to Bloomberg. The money came from Uranium Finance, a decentralized exchange that did not survive the experience.

On October 7, 2026, a Manhattan federal jury convicted Jonathan Spalletta of computer fraud and money laundering. The jurors needed about two hours to reach their verdict.

Two exploits, one collapsed exchange

Spalletta, who went by the online aliases “Cthulhon” and “Jspalletta,” was tied to two separate attacks on Uranium Finance in 2021. Together, they drained more than $53 million in crypto assets and pushed the platform to shut down.

The first hit landed on April 8, 2021. Spalletta took advantage of the exchange’s reward mechanism to walk away with about $1.4 million.

The second came 20 days later, on April 28, and it was far worse. He exploited flaws spread across 26 liquidity pools to pull out approximately $53.3 million in crypto assets.

After the April 28 attack, Uranium Finance ceased operations. The fallout also triggered a broad federal investigation into where the money went.

From Tornado Cash to Black Lotus

Prosecutors say a large share of the stolen funds was laundered. They allege Spalletta routed roughly $26 million through Tornado Cash, a crypto mixer, between 2021 and 2023.

Some of the money allegedly took a more tangible route. Items reportedly bought with the stolen crypto included a Black Lotus Magic: The Gathering card valued at around $500,000.

The shopping list reportedly also featured first-edition Pokémon sets worth more than $1 million collectively. Then there was a Roman “Eid Mar” coin, which cost approximately $601,500.

In total, over $3 million worth of collectibles were linked to the stolen funds.

Investigators leaned heavily on blockchain forensics to follow the trail. Authorities seized about $31 million in crypto from Spalletta in February 2025.

The road to a verdict

Spalletta was charged in March 2026 and surrendered the same day. He pleaded not guilty.

His trial opened on September 28, 2026, and wrapped with the October 7 conviction. Sentencing is scheduled for February 16, 2027.

He could face up to 30 years in prison across both counts. That breaks down to as many as 10 years for fraud and 20 for money laundering.

The exploits happened in April 2021, the seizure came in February 2025, and charges followed in March 2026.

What the conviction means for DeFi

The case is a reminder that the pseudonymous nature of crypto is not the same as anonymity. Spalletta’s aliases and his alleged use of a mixer did not stop investigators from connecting the dots years later.

The recovery figures also tell a story. With about $31 million seized against more than $53 million taken, forensic tracing clearly works, but it does not necessarily make victims whole.

What to watch next is the February 16, 2027, sentencing date. The punishment handed down will signal how seriously courts intend to treat large-scale DeFi exploits.