Uranium Finance hack verdict shows a $53 million laundering trail

Uranium Finance was an automated market maker on BNB Chain, Binance’s blockchain. That is a kind of decentralized exchange where people deposit pairs of tokens into shared pools, called liquidity pools, and computer code handles the trades with no company in the middle.

Prosecutors said Spalletta hit it twice. On April 8, 2021, he used a flaw in how the platform handed out rewards, sending withdrawal requests for zero tokens that tricked the code into paying him. He took about $1.4 million.

He then gave back roughly $1 million, keeping close to $386,000 as what authorities called a sham bug bounty. A bug bounty is a reward companies pay hackers for reporting flaws; in this case, prosecutors said, it was extortion. In one message after that first attack, he told a Uranium representative to get the code audited next time.

The second attack came on April 28, 2021, and it was far bigger. A check in Uranium’s version 2.1 contracts, the code that confirms a trade balances, used 1,000 where it should have used 10,000. That one missing zero let Spalletta pull out nearly 90% of the assets in 26 liquidity pools while putting in almost nothing.

He walked away with about $53.3 million, most of what Uranium held, and the exchange shut down because it had no funds left. Across both attacks, some estimates put the total at around $54.7 million.

A message quoted in the indictment did not help his defense. In it, he described pulling off a crypto heist and dismissed crypto as fake internet money. US Attorney Jamie McDonald said those words showed indifference to victims, who lost more than $50 million of real money.

1/ Throughout this year I have been monitoring someone who has withdrawn 11,200+ ETH ($25M) from Tornado Cash and spent the majority of it on Magic The Gathering (MTG) trading cards.

Here’s my analysis of where the funds went and what the potential source of funds could be.

— ZachXBT (@zachxbt) December 7, 2023

Tornado Cash is a mixer, a service that pools many people’s crypto and sends it back out so it is hard to see who paid whom. Prosecutors said about $26 million of the stolen funds went through it between April 2021 and November 2023.

The trail did not stay hidden. In December 2023, the online crypto investigator ZachXBT tied the Uranium attacker to more than 11,200 ETH that had come out of Tornado Cash, a haul then valued at $25 million, as shown in the post embedded in this article. Funds came out of the mixer in 100 ETH chunks and were converted and spent.

The shopping list read like a collector’s dream:

• a Black Lotus Magic: The Gathering card for about $500,000
• a complete first-edition set of base Pokémon cards for about $750,000
• 18 sealed Alpha Booster packs of Magic cards for about $1.5 million
• an ancient Roman coin marking the assassination of Julius Caesar for over $601,000
• fabric from the Wright brothers’ airplane that Neil Armstrong later took to the moon, for about $137,500

In February 2025, federal agents seized about $31 million in crypto linked to Spalletta, along with collectibles from his home. He surrendered on March 30, 2026, when his indictment was unsealed.

The trial opened in Manhattan federal court on September 28. His lawyers did not argue that the hacks never happened. Instead, they said prosecutors could not prove who was actually typing, that Spalletta had not written Uranium’s faulty code, and that Tornado Cash is a legitimate privacy tool.

Prosecutors told the jury that stealing from a crypto platform is simply theft, however technical the method. They backed that up with blockchain tracing and his own messages. Jurors began deliberating on a Tuesday afternoon and returned guilty verdicts on both counts the next day.

Afterward, prosecutors asked for GPS monitoring. US District Judge Jed S. Rakoff declined, pointing to the fact that Spalletta had shown up to court.

The case is a reminder that in decentralized finance, the code is the bank vault. If it has a bug, there is often no company or insurer to make you whole, and Uranium’s users lost most of their deposits when it collapsed.

Before you put money into a DeFi app, check whether its smart contracts (the self-running code that holds your funds) have been independently audited, how long it has operated and how much money it holds. Treat newer platforms with little history as high risk, and never deposit more than you can afford to lose.

The other lesson cuts the other way. Blockchains keep a permanent public record, and investigators are getting better at reading it. Money laundered through a mixer in 2021 still led to a seizure and a conviction five years later.