A Missing Zero Opens the Vault
The case stretches back to April 2021, when Uranium Finance, a BNB Chain decentralized finance (DeFi) automated market maker, was hit twice. Prosecutors said Spalletta first exploited a rewards-distribution flaw on April 8 and took about $1.4 million before returning roughly $1 million under what authorities described as a sham bug bounty.
A message quoted in the indictment didn’t exactly help matters:
“I did a crypto heist of $1.5MM a couple of weeks ago… There was a bug in a smart contract, and I exploited it… Crypto is all fake internet money anyway.”
Then came the big score. On April 28, a faulty mathematical check in Uranium’s version 2.1 contracts effectively left a zero out of the equation. Prosecutors said Spalletta exploited the flaw across 26 liquidity pools and made off with about $53.3 million, leaving Uranium without funds.
From Tornado Cash to Pokémon
The money trail is where the yarn takes a strange turn. Prosecutors said about $26 million moved through the ether mixing service Tornado Cash between April 2021 and November 2023. Blockchain investigator ZachXBT later traced millions emerging from the mixer in 100 ETH chunks and being converted and spent on collectibles.
The indictment says Spalletta bought a rare “Black Lotus” Magic: The Gathering card for about $500,000, 18 sealed Alpha Booster Magic packs for roughly $1.51 million, and a first-edition Pokémon card base set for about $750,000.
There was more. Purchases allegedly included a $257,500 first-edition Pokémon booster box, a roughly $601,545 Roman Eid Mar coin commemorating Julius Caesar’s assassination and, for about $137,500, fabric from the Wright brothers’ airplane that Neil Armstrong later carried to the moon. Federal agents seized about $31 million in crypto in February 2025, along with collectibles including the Black Lotus and Wright brothers fabric.
‘Whose Fingers Were on the Keyboard?’
At trial, Spalletta’s defense came out swinging on attribution. Counsel argued prosecutors couldn’t prove “whose fingers were on the keyboard,” that Spalletta hadn’t written Uranium’s faulty code, and that Tornado Cash itself was a privacy tool.
The government countered with blockchain tracing and Spalletta’s own messages. In one quoted exchange after the first incident, he told a Uranium representative, “Get your code audited next time.”
The jury rejected the defense on both counts. At press time, the next act remained unwritten: no sentencing date had been set, restitution and forfeiture questions remained open, and no Justice Department conviction release had appeared.
