From Crypto Heist to Black Lotus: Jury Convicts Maryland Man in $50 Million Uranium Finance Hacks

Published Oct. 15, 2026. Case statuses are current as of that date.

Collectors know the names on this list: a "Black Lotus," sealed Alpha Booster packs, a first edition Pokémon base set. According to federal prosecutors in Manhattan, those cards were bought with money stolen from a cryptocurrency exchange that collapsed after it was drained.

On Oct. 7, 2026, a federal jury convicted Jonathan Spalletta, 36, of Rockville, Maryland, of one count of computer fraud and one count of money laundering over two 2021 hacks of the decentralized exchange Uranium Finance. He was convicted on all counts after a six-day trial before U.S. District Judge Jed S. Rakoff, the U.S. Attorney's Office for the Southern District of New York said [1].

Status note: Spalletta has been convicted by a jury but has not been sentenced. A conviction can be appealed. The cards and other items described below are where prosecutors say part of the proceeds went; no count in the case concerns a card transaction [2].

How the hacks worked, according to prosecutors

Uranium was a decentralized exchange where users deposited and swapped cryptocurrencies through "liquidity pools." According to the indictment, public filings and the trial evidence as summarized by the U.S. Attorney's Office [1]:

1. The first hack (April 8, 2021). Spalletta ran a deceptive series of transactions against Uranium's smart contract to withdraw far more "rewards" than he was entitled to, and repeated them until he had drained the pool of nearly all its reward tokens, taking about $1.4 million.
2. The boast. About two weeks later, prosecutors say, he wrote to another person: "I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway."
3. The "bug bounty." Prosecutors say he then extorted Uranium into letting him keep about $386,000 as a sham "bug bounty," which they say was meant to help him evade prosecution, in exchange for returning the rest.
4. The second hack (April 28, 2021). He exploited an error in the contract that controlled how much could be withdrawn from a pool, across multiple pools, taking about $53.3 million and causing Uranium to shut down "due to lack of funds." Quartz, citing the Justice Department, reported that 26 pools were hit [4].
5. Laundering. The funds were moved through a complex series of crypto transactions, including the mixer Tornado Cash [1].

Where the money went: cards, coins and a piece of the Wright Flyer

According to the U.S. Attorney's Office, Spalletta used the laundered funds to buy [1]:

• a "Black Lotus" Magic: The Gathering card, for about $500,000;
• 18 sealed packs of "Alpha Booster" Magic cards, for about $1,512,500;
• one sealed box of first edition "Booster" Pokémon cards, for about $257,500;
• one first edition complete base set of Pokémon cards, for about $750,000;
• an "Eid Mar Denarius," a Roman coin commemorating the assassination of Julius Caesar, for about $601,545; and
• a piece of fabric from the Wright brothers' original airplane that Neil Armstrong carried to the moon, for about $137,500.

The Black Lotus, the fabric and some of the coins were seized from his home under a search warrant, and on Feb. 24, 2025, agents seized cryptocurrency worth about $31 million at the time [1]. Cardboard Police, a hobby news site, added up the four card lots at about $3.02 million and noted that a seized slab pictured by prosecutors carried a Heritage Auctions lot label. That total is the site's own arithmetic, not a figure from prosecutors [2].

The person convicted

Jonathan Spalletta, 36, Rockville, Maryland (also known as "Cthulhon" and "Jspalletta," per prosecutors) [1]

• Verdict (Oct. 7, 2026): guilty of computer fraud (maximum 10 years) and money laundering (maximum 20 years). Maximums are set by Congress; the judge decides the sentence.
• Court: U.S. District Court, Southern District of New York. Inner City Press, which covered the trial, lists the case as USA v. Spalletta, 1:26-cr-118 [5].
• Sentencing: Quartz, citing Bloomberg, reported that Judge Rakoff set sentencing for Feb. 16 and that the jury deliberated about two hours [4]. We have not seen the date on the docket.

Red flags for collectors and crypto users

• "Code is law" is not the law. Calling an exploit a "bug" or demanding a "bounty" after taking funds does not make it legal, as this verdict shows.
• Big buyers with unexplained crypto wealth. High-end cards are portable stores of value. Dealers and auction houses should know their customers, especially when crypto is involved.
• Provenance matters. Items bought with criminal proceeds can be seized. When buying grail cards, keep records of where a card came from and who sold it.
• DeFi risk is real. A smart-contract flaw can empty a platform overnight. Uranium shut down after the second hack [1].

What to do if you lost money

1. Uranium users: the U.S. Attorney's Office asks anyone who believes they were a victim of the Uranium hack to contact Homeland Security Investigations at the email address listed in its release [1][3].
2. Report crypto theft to the FBI at ic3.gov, with wallet addresses and transaction IDs.
3. Beware of "recovery" offers. Scammers often contact hack victims promising to get funds back for a fee. Law enforcement does not charge victims.

Case status (as of Oct. 15, 2026)

Defendant	Court	Status as of Oct. 15, 2026	Source
Jonathan Spalletta, 36, Rockville, Md.	U.S. District Court, S.D.N.Y. (1:26-cr-118, per Inner City Press)	Convicted by jury Oct. 7, 2026, of computer fraud and money laundering; awaiting sentencing (Feb. 16 reported by Quartz/Bloomberg)	[1], [4], [5]

Statuses can change. Convictions can be appealed.

Sources

1. U.S. Attorney's Office, Southern District of New York, "Jonathan Spalletta Convicted For Defrauding Crypto Exchange Of Over $50 Million In Hacks," Oct. 7, 2026. https://www.justice.gov/usao-sdny/pr/jonathan-spalletta-convicted-defrauding-crypto-exchange-over-50-million-hacks-0
2. "A Manhattan Jury Convicted a Crypto Hacker — and $3.02 Million of the Money Went Into Cards," Cardboard Police, Oct. 9, 2026. https://www.cardboardpolice.com/spalletta-convicted-uranium-finance-card-purchases
3. "Uranium Finance Hacker Who Bought Pokémon and Magic Cards Convicted Over $50M Theft," Decrypt, Oct. 8, 2026. https://decrypt.co/380401/uranium-finance-hacker-who-bought-pokemon-and-magic-cards-convicted-over-50m-theft
4. Cris Tolomia, "Cybersecurity consultant convicted in $55 million crypto hack," Quartz, Oct. 7, 2026. https://qz.com/jonathan-spalletta-cybersecurity-consultant-convicted-crypto-hack-100726
5. Matthew Russell Lee, "Spalletta Convicted of Uranium Finance Hack After Two Hour Jury Deliberation in SDNY," Inner City Press, Oct. 7, 2026. https://www.innercitypress.com/sdny229erakoffspallettaicp100726.html

---

Corrections and updates: If you are named in this article, or represent someone who is, and believe anything here is inaccurate or out of date (including a dismissal, acquittal, or change in case status), please contact us at editorandchief@scammers.com. We will review it and update the article promptly.