Maryland Man’s $54M Crypto Heist: Pokémon Cards, Roman Coins & Plane Fabric?

by

Federal prosecutors say a Maryland man who stole more than $54 million from a crypto exchange blew a significant portion of the money on Pokémon cards, antique Roman coins, and a scrap of fabric from the Wright brothers’ plane. Because nothing says “I’m a genius” like buying a 100-year-old coin and a piece of airplane fabric. Classic.

A Hacker With An Unusual Shopping List

Jonathan Spalletta surrendered to authorities Monday after the US Attorney’s Office for the Southern District of New York unsealed an indictment against him. Agents who searched his home found the collectibles. The items were seized. Spalletta now faces up to 30 years in prison if convicted on all charges – one count of computer fraud and one count of money laundering. Because stealing $54 million and buying Pokémon cards is clearly a career move.

The case centers on two separate attacks against Uranium Finance, a now-defunct crypto exchange that operated on the BNB blockchain. Both hacks happened in April 2021, just weeks apart, and together they wiped out tens of millions of dollars in user funds. The platform never recovered. Because nothing says “I’m a financial wizard” like crashing a crypto exchange and then buying a bunch of old coins.

“Stealing from a crypto exchange is stealing – the claim that ‘crypto is different’ does not chang that,’” said U.S. Attorney Jay Clayton. “For the victims, there is nothing different about having your money taken.”

– US Attorney SDNY (@SDNYnews) March 30, 2026

The first attack, on April 8, was relatively minor by crypto-crime standards. A bad actor exploited a smart contract flaw and walked away with $1.4 million. The two sides eventually reached a private agreement, and all but $386,000 was returned. Then, 20 days later, Spalletta allegedly came back for more. Because obviously, $1.4 million wasn’t enough to fund a lifestyle that includes Roman coins and airplane fabric.

The Second Strike Killed The Platform

The April 28 attack was on another level. According to prosecutors, Spalletta exploited a coding error in Uranium Finance’s withdrawal system, hitting 26 separate liquidity pools in a single sweep. He made off with $53.3 million in Bitcoin, Ether, and the platform’s own U92 token. The exchange shut down shortly after. Victims were left with little information and no recourse. Because nothing says “I’m a victim of a hack” like being left with nothing but a bunch of digital tokens and a sense of betrayal.

Uranium Finance had launched just days before the first hack, during the 2021 bull market. It was built as a fork of Uniswap, a well-known automated trading protocol. The platform never got a chance to grow. By the end of April, it was gone. Because nothing says “I’m a successful startup” like getting hacked twice in a month.

Federal investigators worked the case for years behind the scenes. In early 2025, authorities recovered $31 million in cryptocurrency tied to the hack but offered no public explanation at the time. Monday’s indictment filled in the details. Because obviously, the only thing worse than stealing $54 million is taking five years to figure out who did it.

US Attorney Draws A Hard Line On Crypto Theft

US Attorney Jay Clayton made clear his office views crypto theft the same as any other financial crime. “Stealing from a crypto exchange is stealing,” Clayton said. “For the victims, there is nothing different about having your money taken.” He added that Spalletta caused real losses for real people and is now under real arrest. Because nothing says “I’m a law-abiding citizen” like stealing millions and then buying Pokémon cards.

Spalletta appeared before US Magistrate Ona Wang on Monday to formally hear the charges. Data from the broader crypto industry puts the 2021 hack in context – bad actors stole an estimated $2.6 billion through various exploits that year alone. The biggest was a $610 million breach of the Poly Network, though the hacker in that case eventually returned the funds. Because obviously, returning $610 million is the responsible thing to do after a hack.

The Uranium Finance victims have waited nearly five years for answers. Monday’s indictment was a start. Because nothing says “I’m sorry” like a 30-year prison sentence and a bunch of old coins.

Read More

2026-04-01 00:43