A jury just proved old DeFi hacks still end in prison time.
Signal Snapshot
- A Manhattan jury convicted Jonathan Spalletta on all counts for computer fraud and money laundering.
- The case covers two April 2021 hacks of Uranium Finance that took more than $50 million.
- He washed funds through Tornado Cash. He spent some of it on rare Pokemon and Magic cards.
- Agents seized crypto worth about $31 million in February 2025. Spalletta faces up to 30 years in total.
- The verdict came after a six-day trial before U.S. District Judge Jed S. Rakoff. He was 36 and from Rockville, Maryland.
Key Takeaways
- A federal jury found Jonathan Spalletta guilty for two 2021 hacks of Uranium Finance.
- It matters because it shows old on-chain crime still leads to real prison time today.
- The real read is simple. Code tricks are not free money. Courts treat them as fraud.
What Happened
Spalletta hit Uranium Finance twice in April 2021. The platform was a decentralized crypto exchange. Users pooled funds there to earn rewards. He learned how the reward code worked. Then he used it against the platform.
He sent the same transactions again and again. The smart contract paid him far more than he earned. He then talked with the team after the theft.
This one was much bigger.
He did not just hold the coins. He sent them through Tornado Cash to hide the trail. That tool mixes crypto to break the link to crime. He then cashed out for real-world goods. Those goods included rare Magic: The Gathering cards. They also included rare Pokemon cards. It is a strange shopping list for a hacker.
Police caught up with him years later. He was charged in March. Agents had seized crypto worth about $31 million in February 2025. A Manhattan jury heard the case for six days. It convicted him on every count in the two Uranium Finance hacks. Judge Jed S. Rakoff oversaw the trial. Spalletta now faces up to 10 years for computer fraud. He faces up to 20 years more for money laundering.
Why It Matters
This case draws a clear line for crypto. Finding a bug is not a license to drain funds. Keeping part of the loot is not a bounty. A bounty is paid by agreement before work starts. A payout kept after a theft looks like theft.
It also shows how laundering leaves clues. Tornado Cash can hide flows for a time. It does not erase them forever. Investigators traced the funds across years. They linked wallets to exchanges. They linked exchanges to card buys. Physical goods are hard to hide.
For users, the lesson is blunt. Small new exchanges carry extra risk. Their code may not be tested. Their teams may be thin. When a pool shuts down, funds can freeze fast. There is often no refund path.
For builders, the message is just as blunt. Reward logic needs tight checks. Withdraw math needs tests across pools. A small error can cost tens of millions. A pause switch and audit help but do not fix bad math.
For investors, the read is about trust. A hack from 2021 still shapes views today. People recall who lost money. They recall who paid back. They ask tougher questions now. They want proof of audits. They want proof of controls. They want clear bounty rules.
Here is the deal. The cards make this story fun to share. The law part is what lasts. Courts will call repeated fake withdrawals fraud. They will call pool draining fraud too. Clever code talk will not save a defendant.
Market Context
This is a security event. It is not a market move. It is not a new rule. It is about theft and payback through courts. That puts it in the same bucket as exchange hacks and bridge drains.
Security events hit different from price swings. Price swings fade in days. Hacks stick in memory for years. People remember the name of the platform. They remember the size of the loss. They remember if victims got paid.
The two-step pattern here is common in early DeFi. Step one is a small test. An attacker probes reward payouts. He sees if the team notices. He sees if the code stops him. Step two is the full drain. He hits the core accounting flaw. He takes as much as the pools hold.
The bug bounty twist is also familiar. After a first theft, talks start fast. Teams want funds back. Attackers want to keep a cut. A real bounty has clear terms. It has a scope and a cap. It is paid for a report, not for a drain.
Shutdowns follow this kind of loss. That is normal when funds are gone. Teams cannot pay users with empty pools. They cannot restart trust with no cash. Most users move on to safer names.
Seizures tell the next part. About $31 million was seized by February 2025. That is less than the total taken. It is still a large clawback. It shows agents can find coins years later. Prices move, so seized value shifts too. The headline loss and the seized sum will rarely match.
Tornado Cash is part of this context. It is a mixing tool on chain. People use it for privacy. Criminals use it to hide theft. Cops now watch mixers closely. They track deposits and exits. They look for plain mistakes like card orders.
Trading cards add color but do not change the class. This stays a security event with a laundering tail. The cards help prove spending. They link on-chain funds to a real person. They turn wallet rows into store receipts.
Risks to Watch
The first risk is sentencing risk. The max is 10 years on one count. It is 20 years on the other. The judge will pick the real term later. Federal terms often run below the max. They still send a strong signal.
The second risk is victim payback. Seized coins may go back to victims. The process is slow and complex. Claims take time to sort. Prices shift while cases move. Victims may get less than they lost.
The third risk is copycat logic. Other old hacks may still lead to charges. On-chain records do not fade. Wallets stay linked. A buyer of rare goods leaves a trail. Time does not clean that trail.
What would make this matter less? A light sentence would soften the signal. A failed seizure appeal could cut payback. Proof of a real bounty deal would change the read. None of that is in the record now. The jury rejected that view.
What would make it matter more? A long prison term would raise the cost of hacks. A clear payback plan would help victims. New details on tracing would help teams. Each would lift this from one case to a playbook.
What to Watch Next
- Watch the sentencing date and the final prison term. That number sets the tone for like cases.
- Watch for a payback plan for the seized $31 million in crypto. See who files claims and when.
- Watch for more detail on the trail from Tornado Cash to card buys. That shows how agents linked wallets to a name.
- Watch for any appeal filing by the defense. An appeal would keep the legal fight alive for months.
- Watch for comment from Uranium Finance users or admins on refunds. Their word will shape how this end is seen.
- This article is for info only and is not investment advice. Do your own work and talk to a pro if needed.
