Jury needs two hours to reject “code is law” defense in $55M Uranium Finance hack

A Manhattan jury has convicted Jonathan Spalletta of computer fraud and money laundering over two 2021 hacks that drained more than $50 million from decentralized exchange Uranium Finance. 

The jury’s guilty verdict comes despite a precedent allowing bad actors like Spalletta to go scot-free. 

Was the Uranium Finance hacker found guilty? 

The U.S. Attorney’s Office for the Southern District of New York announced on Wednesday that Jonathan Spalletta, who also went by the online handles “Cthulhon” and “Jspalletta,” was found guilty on every count in the indictment. The verdict followed a trial before U.S. District Judge Jed S. Rakoff that the Justice Department described as lasting six days.

Jurors returned their decision after roughly two hours of deliberation, according to Inner City Press, which live-tweeted the proceedings from the SDNY courthouse. 

U.S. Attorney Jamie McDonald said in the office’s statement that Spalletta repeatedly “exploited vulnerabilities in the code of a decentralized cryptocurrency platform” in order to steal tens of millions of dollars. 

Uranium Finance, which lets users deposit and swap cryptocurrencies through liquidity pools, was attacked twice by Spalletta in April 2021.

The first attack occurred on April 8, 2021, and he made use of a looping set of transactions against Uranium’s smart contract to claim far more reward tokens than he was owed. He repeated that until he pulled out about $1.4 million, draining the pool’s rewards. 

An even larger breach came on April 28, 2021, when Spalletta exploited a flaw in the contract that controlled how much he could withdraw. He exploited that flaw across 26 separate liquidity pools. 

The DOJ’s original charging announcement stated that Spalletta made off with roughly $53.3 million from the attack and left Uranium without the funds to keep operating.

The prosecution mentioned that about two weeks after the first exploit, Spalletta wrote to an acquaintance that he had pulled off “a crypto heist of $1.5MM,” explaining there was “a bug in a smart contract” that he exploited, before adding that “Crypto is all fake internet money anyway.”

After that first hack, prosecutors say, he pressured Uranium into letting him keep roughly $386,000 as a “bug bounty.” The DOJ characterized the deal as a sham only offered to shield Spalletta from prosecution. 

Does the “code is law” defense work in court?

The theory that “code is law” suggests that anything a smart contract permits is fair game. The theory won a rare victory in May 2025 when a judge suspended the fraud convictions of Mango Markets exploiter Avraham Eisenberg, ruling in part that the platform had no terms stating that his conduct wasn’t allowed. Prosecutors are currently appealing that reversal. 

In a March 2026 hearing, a lawyer for one of the “MEV brothers” accused of a $25 million Ethereum scheme used the Eisenberg acquittal as a precedent for their case. 

Despite this, the fast guilty verdict against Spalletta suggests at least one jury was unmoved by the idea that exploiting a flaw in on-chain code is anything other than theft.

What did Jonathan Spalletta do with the laundered crypto? 

Prosecutors say Spalletta spent the laundered funds on high-end collectibles like a “Black Lotus” Magic: The Gathering card for about $500,000, 18 sealed packs of Alpha Booster Magic cards for roughly $1.5 million, and a sealed box of first-edition Pokémon Booster cards for about $257,500, among other items.

He also bought a Roman “Eid Mar” coin struck to mark the assassination of Julius Caesar for about $601,500. The purchase reportedly also included a piece of fabric from the Wright brothers’ original airplane that Neil Armstrong carried to the Moon.

Authorities seized about $31 million in crypto tied to the exploit in February 2025, and the March indictment marked the first time a defendant was publicly named in the long-dormant investigation. Spalletta, 36, of Rockville, Maryland, surrendered when the charges were unsealed.