Uranium Finance Indictment: Why the 5-Year Gap Is the Warning

SDNY Just Proved On-Chain Anonymity Has an Expiration Date

On March 30, 2026, the U.S. Attorney's Office for the Southern District of New York unsealed an indictment charging Jonathan Spalletta, 36, of Rockville, Maryland, with one count of computer fraud and one count of money laundering in connection with the April 2021 hacks of Uranium Finance, a decentralized exchange. Prosecutors allege that on April 28, 2021, Spalletta exploited a coding error across 26 liquidity pools to fraudulently obtain approximately $53.3 million, causing Uranium Finance to shut down. He surrendered the same day the indictment was unsealed, according to the Department of Justice.

But here is the part the headlines are missing. This is not a story about a smart contract bug. It is a story about time. Nearly five years passed between the exploit and the charge, and the government used every month of that gap to trace, seize, and build a case.

The message is unmistakable: pseudonymity on a public blockchain is not the same as anonymity, and a permanent ledger is a prosecutor's best evidence. Here is what happened, why it matters, and what builders and investors in digital assets should take from it.

Two Hacks, a Sham Bug Bounty, and a Trail of Collectibles

The indictment describes a two-step scheme, not a single opportunistic exploit.

• First hack (April 8, 2021). Spalletta allegedly exploited Uranium Finance's rewards mechanism to drain approximately $1.4 million, then negotiated a sham 'bug bounty' that let him keep roughly $386,000.
• Second hack (April 28, 2021). He allegedly exploited a coding error across 26 liquidity pools to obtain approximately $53.3 million, forcing the platform to shut down.

The DOJ, per the CoinDesk report on the case, alleges the proceeds were laundered through Tornado Cash and then spent on rare collectibles that leave a paper trail money never does.

What the money bought

According to the indictment, stolen funds went toward a 'Black Lotus' Magic: The Gathering card (~$500,000), 18 sealed 'Alpha Booster' Magic: The Gathering packs (~$1,512,500), a sealed box of first-edition Pokémon booster cards (~$257,500), a first-edition complete Pokémon base set (~$750,000), and an 'Eid Mar Denarius' Roman coin commemorating Julius Caesar's assassination (~$601,000).

The irony is sharp. The defendant allegedly used a privacy mixer to obscure the crypto, then converted it into physical objects with auction records, provenance documentation, and named sellers. The laundering worked on-chain. It failed the moment the value left the chain.

Reading the Enforcement Signal: The Tornado Cash Timeline Cuts Both Ways

For anyone tracking how the government builds crypto cases, the Tornado Cash sequence in this matter is the most instructive detail.

Tornado Cash was not sanctioned when the alleged laundering occurred. OFAC did not add Tornado Cash to the SDN List until August 8, 2022, more than a year after the 2021 hacks. So the money laundering charge here does not rest on a sanctions violation. It rests on ordinary concealment of criminal proceeds under federal money laundering statutes.

The sanctions story kept moving. The Fifth Circuit ruled on November 26, 2024, in Van Loon v. Department of the Treasury that OFAC exceeded its authority, and OFAC delisted Tornado Cash on March 21, 2025.

The signal for the industry

• Using a mixer is not itself the crime charged. The charge is laundering the proceeds of computer fraud. The tool is evidence of intent, not the offense.
• Delisting a protocol does not launder its history. Tornado Cash coming off the SDN List did nothing to erase the transactions investigators had already mapped.
• Seizure came before the charge. On February 24, 2025, law enforcement seized, pursuant to a judicially-authorized seizure warrant, cryptocurrency worth approximately $31 million at the time of seizure. The government secured the assets first and unsealed the indictment thirteen months later.

That sequence is the pattern. Trace, seize, then charge. Enforcement teams are patient, and the ledger does not forget.

What DeFi Builders and Investors Should Do Now

The Uranium Finance matter is a live case, not a settled one. No plea or conviction has occurred. But the charging theory is a roadmap for how these prosecutions run, and it points to concrete steps.

First, treat smart contract audits as legal risk management, not just engineering hygiene. The second hack exploited a coding error across 26 liquidity pools. A single flawed migration wiped out a protocol. Founders should document audit scope, remediation, and the decision record behind each deployment.

Second, understand what a 'bug bounty' actually is. Prosecutors characterized the first payout as a sham bounty. A legitimate bounty program has published terms, defined scope, and a paper trail that distinguishes white-hat disclosure from extortion. Get that framework in place before you need it, with digital asset counsel who can structure it defensibly.

Third, assume every on-chain movement is discoverable. The five-year gap between the 2021 hacks and the 2026 indictment shows that dormant funds are not safe funds. Blockchain analytics, subpoenas to off-ramps, and seizure warrants close the loop.

Fourth, know your maximum exposure. Spalletta faces a maximum of 10 years for computer fraud and 20 years for money laundering, a combined statutory maximum of 30 years. Those are federal felony numbers, not regulatory fines.

The distinction that matters: a protocol exploit is not a legal gray zone because the code allowed it. 'The contract permitted it' is not a defense to computer fraud.