Federal attorneys have accused a Maryland resident of stealing over $53 million by twice hacking into the Uranium Finance cryptocurrency exchange and concealing the stolen funds using a crypto tumbler.

Jonathan Spalletta, 36, (known as “Cthulhon” and “Jspalletta” online) appeared before Judge Ona T. Wang after surrendering to authorities on Monday.

In April 2021, Spalletta allegedly broke into the Uranium decentralized crypto exchange (an automated market maker similar to Uniswap), stealing about $53.3 million in cryptocurrency and causing the company to close due to insufficient funds.

“Jonathan Spalletta allegedly repeatedly exploited vulnerabilities in smart contracts to illicitly obtain millions of dollars, effectively destroying a cryptocurrency exchange,” stated U.S. Attorney Jay Clayton.

“Spalletta allegedly described his supposed ‘heist’ to another person, saying, ‘Crypto is just fake internet money anyway.’ Taking from a crypto exchange is still theft—the idea that ‘crypto is different’ doesn’t change that. The victims certainly feel the effects. Spalletta caused significant financial harm to real individuals, and now he has been apprehended.”

According to the publicly available official document, the accused carried out two distinct cyberattacks. The initial attack, executed on April 8, involved exploiting a weakness in Uranium’s smart contract code, misusing the AmountWithBonus variable to issue instructions for token withdrawals of zero value and effectively forcing the exchange to award unearned rewards, thereby depleting liquidity by approximately $1.4 million.

Subsequently, Spalletta is said to have coerced Uranium into designating nearly $386,000 of the pilfered funds as a fraudulent “bug bounty,” ostensibly in exchange for the restitution of the remainder to the cryptocurrency exchange.

Three weeks later, on April 28, he allegedly struck again, capitalizing on a separate single-character coding mistake that led Uranium’s transaction-verification process to utilize 1,000 instead of 10,000.

This supposedly allowed Spalletta to extract virtually 90% of the assets from 26 distinct liquidity pools while contributing essentially no tokens, accumulating around $53.3 million (the majority of Uranium’s assets), which resulted in the exchange’s immediate termination.

Spalletta purportedly disguised the digital funds by sending them across various decentralized exchanges via the Tornado Cash cryptocurrency mixing service, and he invested the stolen assets in various opulent goods, such as a “Black Lotus” Magic: The Gathering card valued at roughly $500,000, 18 unopened Alpha Booster Magic card packs worth about $1.5 million, a complete first-edition Pokémon base compilation for around $750,000, and an antique Roman coin commemorating Julius Caesar’s death valued at more than $601,000.

In February 2025, law enforcement personnel executed a court-authorized search of his home, confiscating the collectibles and retrieved around $31 million in cryptocurrency from digital wallets owned by Spalletta.

If convicted of computer fraud, Spalletta could face a maximum sentence of 10 years, and a conviction for money laundering could result in a prison term of up to 20 years.