Cybersecurity consultant found guilty of stealing $55M in crypto from Uranium Finance

Background

A Maryland cybersecurity consultant has been found guilty of stealing nearly $55 million in crypto from Uranium Finance, a decentralized exchange that did not survive the experience.

The Exploits

Spalletta, who went by the online aliases "Cthulhon" and "Jspalletta", was tied to two separate attacks on Uranium Finance in 2021. Together, they drained more than $53 million in crypto assets and pushed the platform to shut down. The first hit landed on April 8, 2021, and Spalletta took advantage of the exchange's reward mechanism to walk away with about $1.4 million. The second came 20 days later, on April 28, and it was far worse. He exploited flaws spread across 26 liquidity pools to pull out approximately $53.3 million in crypto assets.

The Aftermath

After the April 28 attack, Uranium Finance ceased operations. The fallout also triggered a broad federal investigation into where the money went.

The Investigation

Prosecutors say a large share of the stolen funds was laundered. They allege Spalletta routed roughly $26 million through Tornado Cash, a crypto mixer, between 2021 and 2023. Some of the money allegedly took a more tangible route. Items reportedly bought with the stolen crypto included a Black Lotus Magic: The Gathering card valued at around $500,000.

The Verdict

Spalletta was convicted on October 7, 2026, by a Manhattan federal jury. The jurors needed about two hours to reach their verdict.

The Sentencing

He faces up to 30 years in prison across both counts. That breaks down to as many as 10 years for fraud and 20 for money laundering.

The Impact

The case is a reminder that the pseudonymous nature of crypto is not the same as anonymity. Spalletta's aliases and his alleged use of a mixer did not stop investigators from connecting the dots years later.

The Future

The recovery figures also tell a story. With about $31 million seized against more than $53 million taken, forensic tracing clearly works, but it does not necessarily make victims whole.

The Sentencing Date

The punishment handed down will signal how seriously courts intend to treat large-scale DeFi exploits.

The Impact on DeFi

The case is a reminder that the pseudonymous nature of crypto is not the same as anonymity. Spalletta's aliases and his alleged use of a mixer did not stop investigators from connecting the dots years later.

The Future of DeFi

The recovery figures also tell a story. With about $31 million seized against more than $53 million taken, forensic tracing clearly works, but it does not necessarily make victims whole.