Five years after someone drained $50 million from a decentralized exchange on BNB Chain, the DOJ has put a name to the exploit. Jonathan Spalletta, 36, of Rockville, Maryland, surrendered to authorities in Manhattan on charges of computer fraud and money laundering tied to the April 2021 Uranium Finance hack, CoinDesk reported on March 31.
The U.S. had already seized approximately $31 million in crypto from Spalletta in February 2025. The criminal charges followed more than a year later.
A Fake Bug Bounty and a $50 Million Drain
Uranium Finance was a decentralized exchange operating on BNB Chain (then called Binance Smart Chain). Its liquidity pools held BNB, BUSD, and other tokens.
Prosecutors allege Spalletta found and exploited vulnerabilities in Uranium's rewards mechanism. On April 8, 2021, he first extracted approximately $1.4 million. He then contacted the protocol team and negotiated what the indictment describes as a fake "bug bounty," retaining roughly $386,000 of the initial theft as a supposed reward for reporting the flaw.
He then went back and drained the rest. The total take exceeded $50 million across key liquidity pools, and the exploit forced Uranium Finance to shut down permanently. The protocol never recovered.
Black Lotus, Pokemon, and an Ancient Coin
The spending pattern that followed reads less like a crypto criminal's playbook and more like a collector's fever dream.
According to the indictment, Spalletta laundered proceeds through Tornado Cash, the Ethereum-based mixer that the U.S. Treasury sanctioned in August 2022. From there, the funds moved into some of the rarest physical collectibles on earth:
- A Black Lotus from Magic: The Gathering, purchased for approximately $500,000. The card is widely considered the most valuable trading card ever printed.
- Sealed Alpha booster packs from Magic's 1993 first edition, totaling roughly $1.5 million.
- First-edition Pokemon card sets worth more than $1 million.
- A Roman "Eid Mar" coin, one of fewer than 100 known to exist, for approximately $601,500.
The collectibles strategy may have been an attempt to park value in assets that are difficult to trace through traditional financial surveillance. Rare physical items trade in private sales, auction houses, and collector networks that sit outside the banking system.
It did not work. The DOJ's blockchain forensics team traced the funds through the mixer and into these purchases. The indictment includes a line from Spalletta's own communications: "I did a crypto heist. Crypto is all fake internet money anyway."
Five Years Is Not Long Enough to Disappear
The timeline is the quiet part of this story. The hack happened in April 2021. The seizure came in February 2025. The charges landed in March 2026. That is a five-year arc from exploit to indictment, during which Spalletta apparently lived openly in Maryland, bought real estate-grade collectibles, and believed the trail had gone cold.
It had not. The DOJ has steadily expanded its blockchain analytics capability since 2020, and cases like this demonstrate that mixing services do not provide permanent anonymity. Tornado Cash obscures the immediate path between sender and receiver, but investigators have developed techniques to correlate deposits and withdrawals across time windows, transaction amounts, and behavioral patterns.
This is the same investigative infrastructure that produced the Bitfinex hack arrests in 2022 (Ilya Lichtenstein and Heather Morgan, $3.6 billion seized) and the Colonial Pipeline ransomware recovery in 2021. The pattern is consistent: large on-chain thefts generate enough signal for federal forensics teams to unwind, even years after the fact.
What Happens to the $31 Million
Spalletta faces one count of computer fraud and one count of money laundering in the U.S. District Court for the Southern District of New York. The seized $31 million represents roughly 62% of the original theft, though the current value of the crypto holdings may differ from the 2021 valuations depending on which assets were held and when they were frozen.
The Uranium Finance protocol has been defunct since the attack. There is no active team or governance structure to receive restitution, which means any recovered funds would likely go through a court-supervised process. Victims who lost liquidity in the pools would need to file claims, assuming the DOJ pursues a forfeiture and restitution framework similar to previous cases.
For the broader DeFi ecosystem, this case reinforces two realities. First, smart contract exploits from the 2020-2021 era are not ancient history in the eyes of federal prosecutors. Second, mixing through Tornado Cash is not a defense. The DOJ has now used Tornado Cash-related evidence in multiple criminal cases, and the precedent is hardening with each prosecution.
Overview
Jonathan Spalletta, 36, of Rockville, Maryland, has been charged with computer fraud and money laundering for the April 2021 Uranium Finance hack on BNB Chain. The exploit drained over $50 million from the protocol's liquidity pools and forced it to shut down. Spalletta allegedly laundered proceeds through Tornado Cash and spent millions on rare collectibles including a Black Lotus Magic card, sealed Alpha booster packs, first-edition Pokemon sets, and a Roman Eid Mar coin. The DOJ seized $31 million in crypto in February 2025. Spalletta surrendered in Manhattan and faces charges in the Southern District of New York.
