The U.S. has just charged a hacker for allegedly attacking Uranium Finance, a decentralized exchange, allowing him to steal $53.3 million worth of cryptocurrency. The U.S. Attorney’s Office for the Southern District of New York is charging Jonathan Spalletta, also known as Cthulhon and Jspalletta, with computer fraud and money laundering, which could land him up to 30 years in prison.
“In describing his alleged ‘heist,’ Spalletta told another individual ‘Crypto is just fake internet money anyway.’ U.S. Attorney Jay Clayton said. “Stealing from a crypto exchange is stealing — the claim that ‘crypto is different’ does not change that. For the victims, there is nothing different about having your money taken. Spalletta cost real victims real losses of tens of millions of dollars, and now he’s under real arrest.”
Spalletta conducted two different attacks on Uranium Finance. During the first attack, he executed a series of transactions on April 8, 2021, that allowed him to receive cryptocurrency “rewards” that were far higher than what he was supposed to receive. He extracted $1.4 million worth of crypto using this loophole but eventually returned the sum after forcing the platform to let him keep around $386,000 as a “bug bounty.” Unfortunately, this did not satisfy him, as Jonathan exploited an error in Uranium’s smart contract 20 days later. The issue affected 26 of Uranium’s liquidity pool, allowing him to steal approximately $53.3 million in cryptocurrency, resulting in the firm’s shutdown.
He then proceeded to launder the stolen crypto, including running it through Tornado Cash to wipe the public blockchain trail. Once the funds were “cleaned,” he then proceeded to make big purchases, including a $500,000 “Black Lotus” Magic: The Gathering card, 18 Magic: The Gather “Alpha Booster” packs costing more than $1.5 million, a sealed first edition Pokémon “Booster” worth $257,500, and a first edition complete base set of Pokémon cards priced at $750,000.
Alongside the U.S. Attorney, Acting Special Agent in Charge Kevin Murphy of Homeland Security Investigations (HSI) San Diego also worked on the case. They’re looking for additional victims of the Uranium hack, asking them to contact the HSI at UraniumVictims@hsi.dhi.gov.
The authorities are stepping up their efforts to crack crypto theft cases, with several alleged perpetrators being caught and tried for their offenses. However, the relative novelty and high value of cryptocurrency mean that hackers would always be tempted to make off with a lifetime's score of a lifetime.
