The U.S. Department of Justice said Wednesday that Spalletta exploited flaws in the code at Uranium Finance, a now-closed exchange where users swapped tokens through liquidity pools. Citing the indictment and trial evidence, the first breach landed on April 8, 2021, when he chained together deceptive transactions against a smart contract to pull more rewards than authorized, repeating the move until he had about $1.4 million.
He then extorted Uranium, compelling a deal that let him keep about $386,000 as a "bug bounty" in return for giving back the rest of the stolen funds. On April 28, 2021, he executed a second exploit, aiming at a flaw that set limits on the amount of crypto that a liquidity pool was permitted to release. Because the vulnerability extended across multiple pools, he was able to take about $53.3 million. Starved of funds, Uranium Finance shut down.
Crypto theft prosecutions are setting the enforcement playbook as they go. Market Briefs covers crypto crime free every morning.
Authorities say Spalletta pushed the stolen cryptocurrency through a complex maze of transactions. They also say some of it bankrolled splashy buys: around $500,000 for a "Black Lotus" Magic card; about $1.5 million for 18 sealed "Alpha Booster" Magic packs; roughly $257,500 for a sealed first edition Pokémon booster box; and about $750,000 for a complete first edition Pokémon base set.
He also purchased a piece of fabric from the Wright brothers' original airplane that Neil Armstrong later took to the moon for roughly $137,500, and spent $601,545 on an "Eid Mar Denarius," an ancient Roman coin marking the assassination of Julius Caesar. In February 2025, officials took possession of cryptocurrency from Spalletta valued at roughly $31 million.
He was convicted on one count of computer fraud and one count of money laundering. The computer fraud charge carries up to ten years in prison, and the money laundering count carries up to 20 years. "Spalletta's crimes cost real people to lose real money - over $50 million dollars - and caused an entire crypto platform to collapse," said U.S. Attorney for the Southern District of New York Jamie McDonald. A judge will set his sentence next year.
In a written message, Spalletta later said: "I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway." For your wallet, the broader point is that the loudest stories are rarely the smartest plans.
How these cases resolve shapes custody and security standards. Get the free Market Briefs daily newsletter and follow it.
