Cybersecurity Consultant Jonathan Spalletta Found Guilty by New York Jury for Stealing Nearly $55 Million from Crypto Exchange
The jury found Spalletta guilty of theft
Cybersecurity consultant Jonathan Spalletta was found guilty by a New York jury for stealing nearly $55 million from the crypto exchange Uranium Finance. After a six-day trial and more than two hours of deliberation, the jury ruled that all charges in the indictment were established.
The prosecution accused him of carrying out two attacks in 2021. The first on April 8 netted about $1.4 million, after which he left about $386,000 as a bug bounty and returned the rest. The second attack on April 28 involved 26 liquidity pools, yielding approximately $53.3 million, leading to the platform's closure due to the withdrawal of funds.
Spalletta, 36, resides in Rockville, Maryland, and uses online aliases including Cthulhon and Jspalletta. Computer fraud can carry a maximum sentence of 10 years, while money laundering involving services like Tornado Cash can lead to up to 20 years. U.S. District Judge Jed Rakoff set the sentencing date for February 16. The case number is 26-cr-118.
The prosecution stated that from April 2021 to November 2023, about $26 million was transferred through Tornado Cash. Law enforcement seized approximately $31 million in crypto assets from his residence, along with over $3 million worth of rare Pokémon and Magic: The Gathering cards.
Seized items included about $500,000 worth of Black Lotus, approximately $1.51 million in Alpha booster packs, about $258,000 in first edition Pokémon booster boxes, and around $750,000 in first edition Pokémon base sets. He also spent over $600,000 on a commemorative ancient Roman silver coin marking the assassination of Caesar and purchased a piece of fabric from the Wright brothers' aircraft that was taken to the moon for about $137,000.
The defense argued that he used publicly available functions within smart contracts and did not forge credentials or deploy malicious code, thus not constituting hacking. The jury did not accept this distinction.
This is not market trading; it is law enforcement recovering funds. The money moved from liquidity pools to mixers, then into cards, ancient coins, and aircraft fragments. The beneficiaries are law enforcement and victims recovering about $31 million in crypto assets and collectibles, while those who treated public functions as a waiver of liability and the collectibles market that handles such stolen goods bear the burden.
Source: Public Information
ABAB AI Insight
Uranium Finance is a decentralized trading platform on the Binance Smart Chain that ceased operations after the two withdrawals in 2021. After the first incident, Spalletta wrote that he had executed a crypto heist of about $1.5 million, claiming that crypto was just fake internet money. The prosecution characterized the subsequent $386,000 left as a false bug bounty rather than a compliant disclosure.
The money's path first went through Tornado Cash, then was broken down into cards and physical items. Black Lotus, first edition Pokémon, Eid Mar silver coins, and moon fabric can all be priced in the auction market and can be seized by warrants. Approximately $31 million in crypto assets have been seized, with collectibles exceeding $3 million. The 20-year maximum for money laundering corresponds to obfuscating the source, not the act of withdrawal itself.
The path is similar to Avraham Eisenberg's case at Mango Markets. He also claimed to use publicly available functions of the protocol, yet the New York jury convicted him of fraud and manipulation. The difference is that Eisenberg targeted oracles and collateral valuation, while Spalletta focused on reward accounting and pool balances. Both cases are at the same stage: callable code does not equate to legal permission.
This reflects regulatory changes impacting the smart contract layer. Public functions lower the technical barrier but do not change the ownership of funds. The jury removed "no malicious code" from the defense in just over two hours, with the mechanism of fraud looking at unauthorized acquisition of others' assets, and then whether there was mixing and purchasing of physical items to sever tracking.
ABAB News · Cognitive Law
Public functions do not equate to funds being available for withdrawal.
If a bug bounty cannot be negotiated, what remains is stolen money.
Mixers sever the path, but auction houses retain receipts.