US Charges Hacker Behind $53 Million Uranium Finance Exploit

US authorities have unsealed an indictment charging Jonathan Spalletta, also known as 'Cthulhon', with computer fraud and money laundering in connection with two 2021 attacks on Uranium Finance. The indictment alleges that Spalletta exploited a rewards-tracking bug in the exchange's smart contracts to repeatedly drain a liquidity pool of approximately $1.4 million.

Spalletta allegedly returned most of the stolen funds after negotiating with the platform, but kept about $386,000 under what prosecutors describe as a sham 'bug bounty' arrangement. The indictment further alleges that Spalletta exploited another flaw across 26 liquidity pools on April 28, obtaining about $53.3 million in crypto and leaving Uranium Finance unable to continue operating.

Between April 2021 and November 2023, Spalletta allegedly funneled around $26 million through Tornado Cash, moving funds across multiple blockchains and wallets to obscure their origin. The US Attorney's Office has stated that 'stealing from a crypto exchange is stealing' and that the case shows courts are taking a harder look at whether smart contract exploits can be treated as lawful.