A Maryland man was indicted by U.S. prosecutors for allegedly stealing more than $54 million from a cryptocurrency platform called Uranium Finance. 

Jonathan Spalletta, 36, was arrested and appeared in court yesterday after prosecutors accused him of launching two different attacks in April 2021 that siphoned millions from the decentralized finance protocol. 

Spalletta is facing one count of computer fraud and one count of money laundering, amounting to a maximum sentence of 30 years in prison. He was released on bail Monday. 

U.S. Attorney Jay Clayton said Spalletta “repeatedly hacked smart contracts to steal millions of dollars’ worth of other people’s money for himself, and destroyed a cryptocurrency exchange in the process.” 

“In describing his alleged ‘heist,’ Spalletta told another individual ‘Crypto is just fake internet money anyway.’ Stealing from a crypto exchange is stealing — the claim that ‘crypto is different’ does not change that,” Clayton said. “For the victims, there is nothing different about having your money taken. Spalletta cost real victims real losses of tens of millions of dollars, and now he’s under real arrest.” 

Court documents unsealed on Monday say Spalletta conducted his first attack on April 8, 2021. He took advantage of mistakes in the platform’s code to extract about $1.4 million worth of cryptocurrency. 

Uranium Finance approached Spalletta and asked him to return the money in exchange for a bug bounty. The two sides eventually agreed that Spalletta would keep $386,000 and return the rest in exchange for not being prosecuted. 

Two weeks after the attack, Spalletta admitted his involvement in the incident, telling a friend that he “did a crypto heist of $1.5MM a couple of weeks ago…There was a bug in a smart contract, and I exploited it…Crypto is all fake internet money anyway.” 

On April 28, Spalletta exploited a different coding error in Uranium’s platform and siphoned $53.3 million in cryptocurrency. Uranium Finance was forced to shut down after the attack drained nearly all of its funds. Spalletta used cryptocurrency mixer Tornado Cash and other tools to launder the funds before buying himself lavish gifts with the stolen money. 

The Justice Department seized several high-priced antique items that he bought using the money. Last February, the Justice Department announced that it had seized about $31 million worth of cryptocurrency that Spalletta had stolen. Law enforcement agencies worked with TRM Labs to trace the laundered funds back to Spalletta. 

The Justice Department urged victims to come forward if they were impacted by the cyber theft. 

Several people responsible for large crypto thefts have faced charges from the DOJ in recent years as law enforcement has gotten a better handle on investigating attacks on cryptocurrency platforms. 

The man behind a $110 million theft from popular crypto platform Mango Markets was convicted in 2024 while an Amazon employee pleaded guilty in 2023 to stealing about $12 million from two platforms. A Canadian national was charged last year for his role in stealing $65 million from two platforms between 2021 and 2023.