A New York jury has found Jonathan Spalletta, 36, of Maryland, guilty of theft over the 2021 exploitation of vulnerabilities in Uranium Finance smart contracts that prosecutors said led to losses of about $53.3 million.

The verdict followed a case centered on whether using an exposed flaw in decentralized exchange code amounted to theft. Spalletta’s lawyers argued that he merely used functions the platform had left available to anyone, while prosecutors said he knowingly took funds he was not entitled to and later tried to conceal and spend the proceeds.

How prosecutors said the exploit unfolded

According to the Justice Department, Spalletta first identified a flaw in Uranium Finance’s code on April 8, 2021. Prosecutors said he used it repeatedly and collected roughly $1.4 million that he was not owed.

Two weeks later, he described that earlier incident in writing, saying, “I did a crypto heist of $1.5MM a couple of weeks ago … There was a bug in a smart contract, and I exploited it … Crypto is all fake internet money anyway.” Prosecutors also alleged that he then pressured Uranium into allowing him to keep $386,000 as a supposed bug bounty for reporting the flaw, a claim the government characterized as a sham.

On April 28, prosecutors said, he exploited a second vulnerability and drained about $53.3 million from multiple liquidity pools. Uranium Finance then shut down.

Defense argument and jury decision

The defense maintained that Spalletta had only used mechanisms that Uranium Finance itself made accessible through its code. That argument put the trial’s focus on the line between exploiting software behavior and stealing user assets.

Jurors rejected that position. They returned a guilty verdict on Wednesday after about two hours of deliberation. Spalletta now faces a potential sentence of up to 30 years in prison.

What happened to the money

Prosecutors said Spalletta first routed the proceeds through Tornado Cash, a service designed to obscure the origin of crypto funds. The government presented that step as part of an effort to hide where the assets came from.

Authorities also detailed a series of high-value purchases allegedly made with the stolen funds. Those included a first-edition Pokémon base set for about $750,000, a sealed booster box for $257,500, a Black Lotus card for $500,000, a Roman coin linked to the assassination of Julius Caesar for $601,545, and a piece of Wright brothers aircraft fabric that Neil Armstrong carried to the moon for $137,500.

Seizures and the next step

Federal agents later seized about $31 million in cryptocurrency from Spalletta’s home, along with the Black Lotus card and the moon-flown Wright brothers fabric. Those recoveries were part of the government’s case tying the exploit proceeds to later purchases and holdings.

After the verdict, the case now moves to sentencing. A statement from US Attorney Jamie McDonald said the victims of the exploit knew that crypto was not “fake internet money,” rejecting language prosecutors attributed to Spalletta in his written message.

Source: beincrypto.com