Hacker Convicted in $50M Theft Tied to Pokémon and Magic Cards

Uranium Finance hacker convicted after laundering $50M-plus in crypto and buying rare trading cards

A Manhattan jury has convicted Jonathan Spalletta, a 36-year-old cybersecurity consultant from Rockville, Maryland, for computer fraud and money laundering tied to two 2021 hacks of decentralized exchange Uranium Finance, according to the U.S. Attorney’s Office for the Southern District of New York.

Prosecutors said Spalletta—who also went by the online handles “Cthulhon” and “Jspalletta”—stole more than $50 million in cryptocurrency by exploiting Uranium Finance’s smart contracts. The verdict followed a six-day trial before U.S. District Judge Jed S. Rakoff.

Spalletta was convicted on all counts and faces a maximum sentence of 10 years for computer fraud and 20 years for money laundering.

In the first incident, on April 8, 2021, prosecutors said Spalletta repeatedly triggered a series of transactions to withdraw more rewards than he was entitled to, taking about $1.4 million.

The government said a later exploit drained roughly $53.3 million, with the combined total across both attacks reaching about $54.7 million in stolen cryptocurrency. Authorities said the hacks contributed to Uranium Finance shutting down.

Prosecutors also detailed what happened to the proceeds. They said Spalletta moved the stolen crypto through a web of transactions that included Tornado Cash, a mixer designed to obscure on-chain transaction trails, and then spent part of the funds on high-end collectibles.

Among the purchases presented at trial, the Justice Department said Spalletta bought:

• A Black Lotus Magic: The Gathering card for approximately $500,000
• 18 sealed Alpha Booster packs for approximately $1,512,500
• A sealed box of first-edition Pokémon booster packs for approximately $257,500
• A complete first-edition Pokémon base set for approximately $750,000

Additional items cited in the case included a Roman coin marking Julius Caesar’s assassination and Wright brothers fabric described as having flown to the moon.

Authorities said they seized cryptocurrency connected to the hacks worth about $31 million at the time of seizure in February 2025.

The case stands out for more than the unusual spending trail. It reflects the Justice Department’s continued push to treat certain smart contract exploits as criminal conduct—particularly when prosecutors argue the activity involved deception, unauthorized access, or laundering—rather than as a grey-area “code is law” tactic.