U.S. prosecutors have moved forward with charges against a Maryland resident accused of carrying out two exploits that drained more than $54 million from the decentralized finance platform Uranium Finance.
Summary
- US prosecutors have charged a Maryland resident over two 2021 Uranium Finance exploits that resulted in more than $54M in losses.
- Authorities said smart contract flaws were used to withdraw excess funds, with the second breach effectively forcing the platform to shut down.
- Law enforcement has seized about $31M tied to the case, while the accused now faces fraud and money laundering charges.
Court filings unsealed by the U.S. Attorney’s Office for the Southern District of New York named Jonathan Spalletta as the individual behind the April 2021 incidents. Authorities confirmed he surrendered earlier this week and now faces charges tied to computer fraud and money laundering, which together carry a potential sentence of up to 30 years.
Officials allege the attacks relied on vulnerabilities within Uranium Finance’s smart contracts, allowing unauthorized withdrawals that far exceeded permitted reward amounts. Prosecutors said the scale of the losses ultimately forced the platform to cease operations, leaving affected users without a clear recovery path.
“Stealing from a crypto exchange is stealing—the claim that ‘crypto is different’ does not change that. For the victims, there is nothing different about having your money taken. Spalletta cost real victims real losses of tens of millions of dollars, and now he’s under real arrest,” U.S. Attorney Jay Clayton said in an accompanying statement.
Uranium Finance launched during the peak of the 2021 bull cycle as a fork of Uniswap on BNB Chain. Within days of going live, the platform suffered its first breach on April 8, when an exploit allowed excess rewards to be withdrawn.
Most of those funds were later recovered through a negotiated arrangement, though roughly $386,000 remained unreturned.
A second and far larger incident followed on April 28. Investigators said a flaw tied to withdrawal limits across multiple liquidity pools enabled the extraction of roughly $53.3 million in digital assets, including Bitcoin, Ether, and the platform’s native token. The second breach effectively marked the end of Uranium Finance’s operations.
According to prosecutors, a portion of the stolen proceeds was converted into physical collectibles. Items seized during a search of Spalletta’s residence included Pokémon cards, ancient Roman coins, and a historical artifact linked to the Wright brothers’ early aviation work.
Authorities had already recovered part of the missing funds prior to the indictment. In February of last year, law enforcement seized approximately $31 million in cryptocurrency connected to the exploits, though details were not disclosed at the time.
The case is expected to proceed before U.S. Magistrate Ona Wang, where Spalletta will formally respond to the charges.