A Rockville man is facing federal charges tied to a massive cryptocurrency hack that allegedly drained tens of millions of dollars from a decentralized exchange.
Federal prosecutors in the Southern District of New York announced March 30 that Jonathan Spalletta, 36, has been charged with computer fraud and money laundering in connection with two 2021 cyberattacks targeting Uranium Finance, a decentralized cryptocurrency exchange. Spalletta, also known online as “Cthulhon” and “Jspalletta,” surrendered to authorities and is expected to appear before a U.S. Magistrate Judge in New York.
According to the indictment, Spalletta carried out two separate exploits in April 2021 by taking advantage of vulnerabilities in Uranium’s smart contracts. In the first incident on April 8, he allegedly manipulated transactions to repeatedly withdraw more cryptocurrency rewards than permitted, ultimately extracting about $1.4 million. Prosecutors say he later acknowledged the scheme in writing, describing it as a “crypto heist,” and attempted to legitimize part of the theft by negotiating a so-called “bug bounty,” allowing him to keep approximately $386,000 while returning the rest.
The second attack, on April 28, was significantly larger. Investigators allege Spalletta exploited another flaw across 26 liquidity pools, siphoning off roughly $53.3 million in cryptocurrency and effectively forcing Uranium Finance to shut down due to lack of funds.
Authorities say Spalletta then laundered the stolen funds through a complex web of cryptocurrency transactions, including the use of the mixer Tornado Cash, before converting portions into high-value collectibles. Among the items allegedly purchased were a rare “Black Lotus” Magic: The Gathering card valued at approximately $500,000, sealed packs of early-edition Magic cards totaling more than $1.5 million, high-end Pokémon card sets, antique Roman coins, and even a historic piece of fabric from the Wright brothers’ airplane that later traveled to the moon with Neil Armstrong.
Law enforcement officials also revealed that approximately $31 million in cryptocurrency linked to the scheme was seized in February 2025.
If convicted, Spalletta faces up to 10 years in prison for the computer fraud charge and up to 20 years for money laundering. Prosecutors emphasized that the charges are allegations, and he is presumed innocent unless proven guilty in court.
No mugshot was released. Officials are asking anyone who believes they may have been affected by the Uranium hack to contact federal investigators.
