In April 2021, the decentralized exchange Uranium Finance lost nearly all of its reserves in a single afternoon. The protocol, built on BNB Chain, shut down for good, thousands of users lost access to their funds, and the case went cold for more than five years. On Wednesday, a New York jury put an end to the mystery: it found Jonathan Spalletta, a cybersecurity consultant, guilty of orchestrating both attacks himself.
The theft came in two moves. Spalletta first drained $1.4 million to test a flaw in the contract, then waited to see if anyone noticed. A few hours later, confident the coast was clear, he pulled out the remaining $53.3 million, wiping out the exchange's liquidity for good. The root cause was a rebasing bug introduced during a contract migration — a single wrong exponent threw off the pool's entire balance calculation.
What gave him away wasn't the hack itself but what came after. Investigators who searched his home found a collection of rare Pokémon and Magic: The Gathering cards worth roughly $3 million, an antique Roman coin bought for $600,000, and an artifact tied to the Wright brothers that cost $137,000. Tracing those purchases back through auction houses and collectible dealers is what eventually connected the wallets to his name.
The jury took only two hours to reach its verdict. Spalletta faces up to 20 years in prison, with sentencing set for February 16. For the DeFi industry, the case matters less for the dollar amount — plenty of hacks have topped $50 million — and more for what it proves: five years on, blockchain forensics can still turn an unsolved exploit into a conviction, rather than letting it fade into another unpunished loss.
