Pokemon fan charged with $55M crypto hack goes on trial
A Maryland cybersecurity consultant who allegedly stole nearly $55 million in hacked cryptocurrency and spent some of it on rare Pokemon and Magic: The Gathering cards went on trial in New York.
Jonathan Spalletta was charged in March with two 2021 hacks of cryptocurrency exchange Uranium Finance, which allegedly shut down as a result. Opening statements in the case began Monday in Manhattan federal court. Spalletta, who has pleaded not guilty, faces a maximum of 20 years in prison if convicted of the most serious charge against him.
Addressing the jury, federal prosecutor Shaun Werbelow said Spalletta “orchestrated a plan to destroy a whole cryptocurrency platform, to steal $50 million and then launder the money he stole.”
Defense lawyer Shrey Sharma conceded that Spalletta interacted with Uranium but denied that he hacked the platform, arguing that he didn’t use spoofed credentials or malicious code to bypass any access control system. Sharma said he used publicly available functions built into the exchange’s smart contracts—computer programs that automatically execute transactions when predetermined conditions are met.
The case has attracted some attention because of the collectibles Spalletta allegedly bought with the hacks’ proceeds. The government seized from his Rockville residence more than $3 million worth of rare cards from the Magic: The Gathering and Pokemon games. The value of such cards has increasingly made them targets of crime.
Spalletta also allegedly spent more than $600,000 on a Roman coin commemorating the assassination of Julius Caesar and $137,500 for a piece of fabric from the Wright Brothers original airplane that Neil Armstrong took with him to the moon. Authorities seized those collectibles along with $31 million in crypto.
Sharma disputed the government’s suggestion that Spalletta hacked Uranium to fund his collectable purchases, noting the latter started in 2023. There is no proof that “the cryptocurrency from Uranium Finance is the same cryptocurrency that was used to make these purchases,” the defense lawyer said.
The trial comes amid a recent wave of crypto hacks, which have remained a persistent threat even as the industry has pushed deeper into mainstream finance. Crypto exchange Bitget said Friday that hackers stole about $357 million, weeks after Bitcoin sidechain Liquid Network disclosed a roughly $320 million theft.
Prosecutors say that, in the first of his two hacks, Spalletta used a deceptive series of transactions to fool Uranium, which paid crypto as a bonus to users who made deposits into the liquidity pools, to grant him more rewards than he was entitled to receive. He repeated the transactions until he had drained the entire reward pool, extracting crypto worth about $1.4 million at the time, according to the government.
Spalletta allegedly bragged about the hack in an email a few weeks later and then extorted Uranium into allowing him to keep $386,000 of the crypto as a “bug bounty,” a reward for finding vulnerabilities in its software.
“Get your code audited next time,” Spalletta told a Uranium representative after he received the payment, according to the indictment.
Just three weeks later, prosecutors say, Spalletta found an exploit that regulated how much he could withdraw from a pool and used it to obtain crypto worth more than $53.3 million at the time. That allegedly caused Uranium to shut down due to lack of funds.
Spalletta then allegedly laundered the proceeds of the hack through a series of transactions, using services such as the cryptocurrency mixer Tornado Cash, the co-founder of which was convicted of running an unlicensed money-transfer operation last August.
The case is U.S. v. Spalletta, 26-cr-118, U.S. District Court, Southern District of New York.
More stories like this are available on Bloomberg.com.
Write a letter to the editor, share a story tip or update, or report an error.
