MD Man Charged in $54M Crypto Hack

Jonathan Spalletta accused of exploiting vulnerabilities to steal millions from Uranium Finance exchange.

Apr. 2, 2026 at 9:34pm

Got story updates? Submit your updates here. ›

An extreme close-up photograph of a cracked and damaged cryptocurrency exchange logo or symbol, lit by a harsh, direct camera flash against a pitch-black background, conveying the stark, gritty aftermath of a major digital theft.A harsh, unforgiving close-up of the aftermath of a major cryptocurrency heist, exposing the vulnerabilities at the heart of decentralized finance.Rockville Today

Jonathan Spalletta, a 36-year-old man from Rockville, Maryland, has been charged in a federal indictment related to a cryptocurrency hack that led to the theft of tens of millions of dollars. Spalletta, who used the online names "Cthulhon" and "Jspalletta", is accused of exploiting vulnerabilities in the Uranium Finance cryptocurrency exchange's smart contracts to steal $1.4 million on April 8, 2021 and $53.3 million on April 21, 2021. Prosecutors say Spalletta used the stolen funds to purchase collectible trading cards and antique coins, and laundered the money through a series of cryptocurrency transactions including the use of the Tornado Cash mixer.

Why it matters

This case highlights the growing threat of cryptocurrency-related crimes, as hackers increasingly target vulnerabilities in decentralized finance (DeFi) platforms to steal large sums of digital assets. The Uranium Finance hack is one of the largest crypto thefts on record, underscoring the need for stronger security measures and oversight in the rapidly evolving crypto industry.

The details

According to the federal indictment, Spalletta exploited vulnerabilities in Uranium Finance's smart contracts to carry out two separate hacks in April 2021. The first incident on April 8 resulted in the theft of $1.4 million, while the second hack on April 21 amounted to $53.3 million. Prosecutors say Spalletta then used the stolen funds to purchase collectible Magic: The Gathering and Pokémon trading cards, as well as antique Roman coins. He also allegedly laundered the money through a "complex series of cryptocurrency transactions" that included the use of the Tornado Cash mixer.

  • On April 8, 2021, Spalletta allegedly exploited vulnerabilities to steal $1.4 million from Uranium Finance.
  • On April 21, 2021, Spalletta allegedly carried out a second hack, stealing $53.3 million from Uranium Finance.
  • Two weeks after the second heist, Spalletta allegedly messaged another person, stating: "I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway."
  • In February 2025, a search warrant executed by authorities resulted in the seizure of cryptocurrency worth $31 million.

The players

Jonathan Spalletta

A 36-year-old man from Rockville, Maryland who was charged in a federal indictment related to the cryptocurrency hack. Spalletta also used the online names "Cthulhon" and "Jspalletta".

Uranium Finance

A cryptocurrency exchange that was the target of the hacks carried out by Spalletta, resulting in the theft of tens of millions of dollars.

U.S. Attorney Jay Clayton

The U.S. Attorney who stated that "Stealing from a crypto exchange is stealing—the claim that 'crypto is different' does not change that." and that Spalletta "cost real victims real losses of tens of millions of dollars."

Homeland Security Investigations

The federal law enforcement agency that is urging anyone who believes they were affected by the Uranium hack to contact them.

Got photos? Submit your photos here. ›

What they’re saying

“Stealing from a crypto exchange is stealing—the claim that 'crypto is different' does not change that. For the victims, there is nothing different about having your money taken. Spalletta cost real victims real losses of tens of millions of dollars, and now he's under real arrest.”

— U.S. Attorney Jay Clayton

“I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway.”

— Jonathan Spalletta

What’s next

Spalletta is facing up to 20 years in prison on the money laundering charge and 10 years for computer fraud. Authorities are urging anyone who believes they were affected by the Uranium hack to contact the Homeland Security Investigations bureau.

The takeaway

This case highlights the growing threat of cryptocurrency-related crimes, as hackers increasingly target vulnerabilities in decentralized finance (DeFi) platforms to steal large sums of digital assets. It underscores the need for stronger security measures and oversight in the rapidly evolving crypto industry to protect investors and users from such large-scale thefts.