Maryland man charged in massive cryptocurrency hacking scheme that drained millions and shut down exchange

New York, New York – Federal prosecutors have unveiled sweeping charges against a Maryland man accused of orchestrating a massive cryptocurrency theft that drained tens of millions of dollars and ultimately led to the collapse of a digital exchange. Authorities announced that Jonathan Spalletta, also known online as “Cthulhon” and “Jspalletta,” has been charged with computer fraud and money laundering tied to attacks on the decentralized cryptocurrency exchange Uranium Finance.

Spalletta, 36, of Rockville, Maryland, surrendered to authorities and is expected to appear before U.S. Magistrate Judge Ona T. Wang, with the case assigned to U.S. District Judge Jed S. Rakoff. The charges were announced by United States Attorney Jay Clayton and Homeland Security Investigations Acting Special Agent in Charge Kevin Murphy.

Alleged scheme drained millions and shut down exchange

According to the indictment, Uranium Finance operated as a decentralized exchange that allowed users to deposit and trade cryptocurrencies through liquidity pools. In April 2021, Spalletta allegedly carried out two separate hacks that exploited weaknesses in the platform’s smart contracts.

The first incident occurred on April 8, 2021. Prosecutors say Spalletta executed a deceptive pattern of transactions that allowed him to withdraw far more cryptocurrency rewards than he was entitled to receive. By repeating the process, he drained nearly all available reward tokens from the system, ultimately taking cryptocurrency valued at about $1.4 million.

In private communications following the theft, Spalletta allegedly described the act openly. He wrote, “I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway.” Authorities say he later pressured Uranium into allowing him to keep approximately $386,000 as a so-called “bug bounty,” returning the remainder in an attempt to avoid prosecution.

The second hack, carried out on April 28, 2021, was far more damaging. Investigators say Spalletta exploited another flaw in Uranium’s system, this time across 26 different liquidity pools. Through that effort, he allegedly obtained approximately $53.3 million in cryptocurrency. The financial blow was so severe that Uranium Finance shut down operations due to a lack of funds.

U.S. Attorney Clayton emphasized the seriousness of the conduct, stating, “As alleged, Jonathan Spalletta repeatedly hacked smart contracts to steal millions of dollars’ worth of other people’s money for himself, and destroyed a cryptocurrency exchange in the process.” He added, “Stealing from a crypto exchange is stealing—the claim that ‘crypto is different’ does not change that.”

Laundering funds and spending on rare collectibles

After obtaining the funds, authorities say Spalletta attempted to hide the origin of the stolen cryptocurrency through a complex series of transactions. This included using Tornado Cash, a cryptocurrency mixer designed to obscure transaction trails.

Investigators allege that once the funds were laundered, Spalletta spent large amounts on high-value collectible items. These purchases included rare trading cards, historic artifacts, and ancient coins. Among the items were a “Black Lotus” Magic card valued at approximately $500,000, 18 packs of sealed “Alpha Booster” Magic cards costing about $1,512,500, and a first edition Pokémon card set worth roughly $750,000.

He also allegedly purchased a unique historical item—a piece of fabric from the Wright brothers’ airplane that was later carried to the moon by astronaut Neil Armstrong—valued at about $137,500. Additionally, authorities identified the purchase of an “Eid Mar Denarius,” an ancient Roman coin linked to the assassination of Julius Caesar, which cost more than $600,000.

Law enforcement later executed a search warrant at Spalletta’s residence and seized several of these items, along with other assets. On February 24, 2025, authorities also seized approximately $31 million in cryptocurrency believed to be connected to the fraud.

Kevin Murphy of HSI stressed the broader implications of the case, saying, “HSI will continue to aggressively pursue those who exploit vulnerabilities in emerging technologies for personal gain and ensure that justice is served for victims of these crimes.”

Spalletta now faces serious penalties if convicted. The computer fraud charge carries a maximum sentence of 10 years in prison, while the money laundering charge carries a maximum of 20 years. Prosecutors from the Complex Frauds and Cybercrime Unit are handling the case, which remains ongoing as authorities continue to identify and assist victims impacted by the scheme.