A federal jury in Manhattan convicted cybersecurity consultant Jonathan Spalletta, also known as “Cthulhon” and “Jspalletta,” of computer fraud and money laundering related to two attacks against the decentralized exchange Uranium Finance in April 2021. The U.S. Attorneys Office for the Southern District of New York announced the decision on October 7, 2026, after a six-day trial before Judge Jed S. Rakoff.
The conviction is a new legal milestone for a years-old exploit, not a fresh October 2026 smart-contract theft. It also has a stronger evidentiary status than an indictment: jurors convicted Spalletta on every count charged.
Two distinct exploits, not one rounded headline
April 8, 2021: prosecutors proved Spalletta repeatedly manipulated Uraniums reward-claim behavior, obtaining about $1.4 million of reward tokens from a liquidity pool. April 28: he exploited a separate liquidity-pool withdrawal-accounting flaw across multiple pools, obtaining about $53.3 million and leaving the platform unable to continue operating. Some publications round the aggregate to about $55 million; the court announcement provides the two-stage amounts and should control the timeline.
How the first attack became a sham bounty
The DOJ recounts a written admission by Spalletta about exploiting a smart-contract bug and taking roughly $1.5 million. After the first attack, he pressured Uranium into letting him retain around $386,000 as a purported “bug bounty” while returning the rest. The government characterized that arrangement as extortion and a sham bounty, not pre-authorized white-hat research.
The distinction matters for exchange users and developers: discovering an exploitable bug does not itself confer permission to remove other users funds or dictate a reward after the fact.
The second exploit and protocol closure
The later attack concerned how much value the contract would permit withdrawals from Uranium liquidity pools. Spalletta exploited the accounting error across several pools, not just one swap. With roughly $53.3 million extracted, Uranium could not sustain the exchange, demonstrating how a calculation error in pooled liquidity can become both asset loss and forced service closure.
Money laundering and post-exploit tracing
Prosecutors said proceeds were routed through complex crypto transactions, including Tornado Cash. They described purchases of rare collectibles: a Black Lotus Magic card (~$500,000), eighteen sealed Alpha Booster packs (~$1.5125 million), a first-edition Pokémon booster box (~$257,500), a complete first-edition Pokémon base set (~$750,000), an “Eid Mar” ancient coin (~$601,545) and aviation memorabilia (~$137,500). The colorful purchases matter because evidence outside the blockchain can link spending, wallets and a natural person.
What was seized—and what victims have actually received
Federal agents seized cryptocurrency worth approximately $31 million at the time of seizure on February 24, 2025. That is a seizure valuation, not confirmation that $31 million was already distributed to victims. Amounts recovered and final victim distributions require separate court/administrative action. The DOJ invited Uranium victims to contact Homeland Security Investigations through an official victim-contact channel; victims should verify such contact information on authenticated government pages, not through social-media messages.
Current legal status and exposure
Spalletta, age 36 at conviction, was found guilty of a computer-fraud count carrying up to 10 years and a money-laundering count carrying up to 20 years. These are statutory maximums, not the sentence imposed. The judge will determine sentencing, and no final imprisonment term should be claimed today.
Why this is different from a mere exploit allegation
The alleged 2021 transaction pattern is now supported by a completed jury verdict. Yet “convicted” is still distinct from “every victim repaid” and “sentence imposed.” WikiBit preserves those separate milestones. The case also illustrates why a protocols publicly callable functions are not a blanket defense against fraudulent manipulation and money laundering.
Evidence Status
Confirmed / Official DOJ: Oct 7 jury verdict, both counts, April 8 ~$1.4M and April 28 ~$53.3M, purported ~$386K bounty, Tornado Cash route, listed purchases, Feb 2025 ~$31M seizure and statutory maximums. Developing: sentencing date and sentence, forfeiture disputes, distribution process, final victim recovery. Not established: the full $31M has been paid to users, or that a conviction creates automatic platform reimbursement.
Risk Assessment
High fraud-enforcement and restitution risk. Liability has advanced to conviction; remaining financial risk is recovering and distributing value from an exchange that already collapsed.
What to Watch Next
Sentencing, forfeiture orders, HSI/DOJ victim communications, appeals and actual distributions—not just gross seizure headlines.
FAQ
Did Uranium Finance get hacked again in October 2026？
No. The verdict concerns two attacks committed in April 2021.
How much was taken？
DOJ describes roughly $1.4M in the first attack and $53.3M in the second.
Is the defendant already sentenced to 30 years？
No. Ten and twenty years are maximum penalties for the two counts, not a sentence.
Did victims receive $31 million？
The government seized assets valued around $31M in February 2025; completed distribution is a separate question.
Was the retained $386,000 an approved bounty？
DOJ described the arrangement as a sham bounty obtained through pressure after the theft.
