A Manhattan jury has convicted Jonathan Spalletta on all counts of computer fraud and money laundering over two 2021 exploits of Uranium Finance that together drained more than $50 million, according to CoinMarketCap. The verdict closes one of the clearer criminal cases to come out of the 2021 DeFi exploit wave, and it lands at a point when most high-value on-chain thefts still end without anyone in a courtroom.
The conviction covers both charge categories prosecutors brought: the computer fraud behind the exploits themselves, and the money laundering that moved the proceeds afterward. A jury agreeing on every count is a stronger signal than a plea deal. It means the evidence linking the on-chain activity to a named individual survived cross-examination in front of twelve people.
A 2021 exploit finally gets a verdict
Uranium Finance was drained twice in 2021, during the first big cycle of automated market maker exploits. Back then, the pattern was familiar and bleak: a contract bug or math error let an attacker extract pooled funds in minutes, the money scattered across chains and mixers, and the trail usually went cold. Most of those cases produced a post-mortem thread and nothing else. Very few produced a defendant.
That is what makes this verdict stand out. More than four years passed between the exploits and the conviction. Blockchain forensics, exchange subpoenas, and cross-border cooperation have matured in that window, and prosecutors were able to assemble enough to convince a jury that the person behind the keyboard was Spalletta. The gap between "the chain shows the funds moved here" and "this specific person is criminally responsible" is where most crypto cases collapse. Here it held.
The laundering charge is the harder half
Draining a contract is a technical act. Turning stolen tokens into usable, spendable value without getting caught is the part that trips up most attackers, and it is often where the evidence against them accumulates. Money laundering convictions in crypto cases tend to rest on the off-ramp: the moment stolen funds touch a regulated exchange, a bank account, or a cash-out service that keeps records.
Securing a guilty verdict on the laundering counts, not just the fraud, suggests prosecutors traced the proceeds through steps that left identifiable fingerprints. That is a recurring theme in enforcement outcomes. The exploit grabs the headline, but the conviction usually comes from how clumsily the money was moved afterward. Analysts have made the same point about other cases this year, including the recent $37M fraud sentencing of Adam Iza, where the financial trail did much of the work.
A conviction shifts the risk calculus for attackers
For protocols and users, the practical takeaway is narrow but real. A single conviction does not make DeFi safe, and it does not recover the lost funds. What it does is shift the risk calculus for would-be attackers who have spent years assuming that a clever exploit plus a mixer equals impunity. A verdict on all counts, years after the fact, undercuts that assumption.
It also reinforces why custody and counterparty design matter more than any after-the-fact enforcement. Law enforcement catching one attacker in 2026 does nothing for the people who lost money in 2021. The only protection that works before an exploit is structural: understanding where funds sit, who controls the keys, and what happens to pooled assets if a contract is drained. For anyone spending from on-chain balances, that is the same logic that makes spending from a wallet you control a different risk profile than parking funds in a pooled contract you do not.
The broader enforcement trend is unmistakable. Courts and agencies that once treated on-chain theft as untraceable are now securing convictions, freezing wallets, and reaching named individuals. The Philippine court that froze 25 crypto wallets in a plunder probe and this Manhattan verdict point the same direction: the gap between an on-chain action and a courtroom consequence is narrowing.
Crypto markets were broadly lower as the news circulated, with Bitcoin at $80,877, down 3.2% on the day as of October 8, 2026, though the verdict itself is an enforcement story rather than a price catalyst.
Overview
Jonathan Spalletta was convicted by a Manhattan jury on all counts of computer fraud and money laundering tied to two 2021 exploits of Uranium Finance that drained over $50 million. The verdict is notable for its completeness, every count, and its timing, more than four years after the exploits. It reflects how far blockchain forensics and cross-border cooperation have come, and it signals that high-value DeFi theft no longer reliably ends in impunity. For users, the lesson is that enforcement is a backstop, not a shield; custody design is what protects funds before an exploit happens.
