Hacker Convicted Over $50M Theft Spent on Trading Cards

A federal jury in Manhattan has found Jonathan Spalletta guilty of money laundering and computer fraud following a six-day trial. The 36-year-old resident of Rockville, Maryland, was convicted in connection with two 2021 cyberattacks on a decentralized crypto exchange that netted more than $50 million, federal prosecutors announced Wednesday.

The attacks resulted in the complete shutdown of the targeted platform, Uranium Finance, after its reserves were drained. U.S. Attorney Jamie McDonald stated, "Spalletta's crimes cost real people to lose real money, over $50 million dollars, and caused an entire crypto platform to collapse."

The digital heist unfolded in two parts. On April 8, 2021, Spalletta interacted repeatedly with the platform's smart contract to extract approximately $1.4 million in unearned rewards. He subsequently pressured the developers to grant him roughly $386,000 under the guise of a sham "bug bounty" in exchange for returning the remaining funds.

Two weeks following the initial intrusion, Spalletta sent a message to an acquaintance detailing his actions. "I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway," he wrote.

On April 28, 2021, the attacker struck the exchange again. This time, he manipulated a withdrawal calculation error spanning multiple liquidity pools. The exploit allowed him to drain approximately $53.3 million, effectively bankrupting the exchange and forcing it to close for lack of funds.

Laundering Through Collectibles

To obscure the stolen assets, Spalletta routed the funds through the cryptocurrency mixer Tornado Cash. He then directed the illicit wealth into high-end physical collectibles, ranging from trading card games to historical artifacts.

His purchases included extensive acquisitions in the Magic: The Gathering and Pokémon trading card markets. For Magic: The Gathering, he acquired a Black Lotus card for roughly $500,000, along with 18 sealed Alpha Booster packs costing about $1.5 million. His Pokémon investments featured a first edition complete base set for approximately $750,000 and a sealed box of first edition booster packs for roughly $257,500.

Beyond trading cards, the stolen funds financed the purchase of an Eid Mar denarius, a Roman coin marking the assassination of Julius Caesar, for about $601,545. He also spent roughly $137,500 on a fabric swatch from the Wright brothers' original aircraft, an artifact that Neil Armstrong had carried to the moon.

Seizures and Sentencing

Law enforcement officers recovered several of the physical items, including the Wright brothers' fabric, the Black Lotus card, and specific coins, through a search warrant executed at his home. In February 2025, authorities also confiscated cryptocurrency connected to the exploits, which was valued at approximately $31 million at the time of seizure.

The case was overseen by U.S. District Judge Jed S. Rakoff. Spalletta, who was officially charged for the incidents in March, now faces significant prison time. He is subject to a maximum sentence of 20 years for the money laundering conviction and an additional 10 years for computer fraud.

The US Attorney for the Southern District of New York noted on social media that prosecutors and agency partners performed outstanding work to ensure the defendant's virtual conduct resulted in a real-world conviction. Meanwhile, Homeland Security Investigations has requested that individuals who believe they were affected by the exchange's collapse contact their office.