Uranium Finance hack verdict shows a $53 million laundering trail

A Maryland man has been found guilty of stealing more than $53 million from Uranium Finance, a decentralized crypto exchange on Binance’s BNB Chain. The two 2021 hacks drained the platform and forced Uranium to shut down for lack of funds. The defendant, Jonathan Spalletta, also known online as Jspalletta and Cthulhon, surrendered to authorities in March and now faces federal sentencing.

The case unfolds in two waves. In the first breach on April 8, 2021, the hacker used a flaw in Uranium’s smart contract to issue zero-token withdrawal commands. That move effectively robbed the liquidity pool and forced the exchange to pay rewards the attacker wasn’t entitled to, about $1.4 million in that single hit. After exploiting the vulnerability, he extorted a sham “bug bounty” of nearly $386,000 from Uranium to recover the rest of the funds.

Three weeks later, a second breach targeted a separate coding error that caused the exchange’s transaction-verification logic to use 1,000 instead of 10,000. That flaw allowed the attacker to withdraw roughly 90% of the assets in Uranium’s liquidity pools while depositing effectively zero tokens, netting about $53.3 million in total. The theft collapsed Uranium and sent shockwaves through the DeFi (decentralized finance) ecosystem.

To launder the proceeds, Spalletta used the Tornado Cash mixer and moved funds across several decentralized exchanges. Investigators later linked tens of thousands of ETH withdrawals to him and recovered roughly $31 million in crypto wallets tied to the case. Prosecutors highlighted the human cost of such crimes, noting real losses for victims and the broader risk to crypto platforms that rely on smart contracts and automated liquidity pools.

Spalletta faces federal sentencing, with authorities indicating that a lengthy term could be possible under the relevant charges. A substantial portion of the stolen assets had already been seized in a 2025 recovery effort.

For ordinary users, the takeaway is clear: DeFi platforms can be highly automated and partially trustless, which makes code flaws dangerous if not audited and monitored. Security researchers urge users to treat such platforms with caution, keep funds in secure wallets, and understand that on-chain activity can be traced and attributed much more than you might expect.

What happens next: Spalletta’s sentencing will determine his formal prison term, and prosecutors may pursue any remaining assets tied to the case. Crypto users should stay aware of ongoing debates around how to secure smart contracts and improve auditing practices across DeFi apps.

1/ Throughout this year I have been monitoring someone who has withdrawn 11,200+ ETH ($25M) from Tornado Cash and spent the majority of it on Magic The Gathering (MTG) trading cards.

Here’s my analysis of where the funds went and what the potential source of funds could be.

— ZachXBT (@zachxbt) December 7, 2023