Maryland Man Charged with Stealing Over $53 Million from Crypto Exchange

A 36-year-old man from Maryland has been charged with stealing over $53 million from the Uranium crypto exchange. According to court documents, Jonathan Spalletta exploited vulnerabilities in the exchange's smart contract code to carry out two separate attacks.

During the first breach, on April 8, 2021, Spalletta used a flaw in the AmountWithBonus variable to issue zero-token withdrawal commands that drained the liquidity pool of approximately $1.4 million. He then extorted Uranium into assigning nearly $386,000 of the stolen funds as a 'bug bounty' in exchange for returning the remainder.

Three weeks later, Spalletta struck again, exploiting a separate coding error to withdraw nearly 90% of the assets held across 26 liquidity pools. The total amount stolen was approximately $53.3 million, forcing the crypto exchange to shut down immediately.

Spalletta laundered the stolen funds through multiple decentralized exchanges using the Tornado Cash cryptocurrency mixer and spent the proceeds on various collectibles, including a 'Black Lotus' Magic: The Gathering card for over $500,000 and an ancient Roman coin commemorating Julius Caesar's assassination for over $601,000.

Law enforcement seized the collectibles from his residence in February 2025 under a court-authorized search warrant and recovered approximately $31 million in cryptocurrency linked to Spalletta. He now faces up to 10 years in prison on computer fraud charges and up to 20 years for money laundering.