Uranium Finance
Last changed 2026-11-03 · Community evidence — A moderator accepted a piece of community-submitted evidence: Decrypt reports a Manhattan federal jury convicted Jonathan Spalletta of computer fraud and money laundering over the 2021 Uranium Finance hacks, max 10 and 20 years, as the note says. Trust score now 0. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·5WdzmK…uvTbSummary
Uranium Finance was a Binance Smart Chain-based automated market maker (AMM) that was exploited twice in April 2021, resulting in total losses of approximately $54.7 million. The larger exploit on April 28, 2021, drained roughly $53.3 million across 26 liquidity pools due to a mathematical error in its forked Uniswap v2 pair contracts; the protocol subsequently shut down permanently. In March 2026, U.S. authorities indicted Jonathan Spalletta, a Maryland resident, on computer fraud and money laundering charges in connection with both attacks, after previously seizing approximately $31 million in cryptocurrency in February 2025.
Connected Entities
6 entities · 60 linked investigations- Uranium Finance→mentioned with→ZachXBT(70%)
- Uranium Finance→mentioned with→Ethereum(75%)
- Uranium Finance→mentioned with→Uniswap(70%)
- Uranium Finance→mentioned with→Binance(70%)
- Jonathan Spalletta→mentioned with→ZachXBT(70%)
- ZachXBT→mentioned with→Ethereum(70%)
- Jonathan Spalletta→mentioned with→Ethereum(65%)
- ZachXBT→mentioned with→Binance(60%)
- Binance→mentioned with→Ethereum(65%)
- Uniswap→mentioned with→Ethereum(80%)
- + 3 more
Connected Through
6 shared actors · 597 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □Binanceorganization
- □ZachXBTorganization
- ⌂Uniswapprotocol
Community submissions
- https://decrypt.co/380401/uranium-finance-hacker-who-bought-pokemon-and-magic-cards-convicted-over-50m-theft(decrypt.co)
“Decrypt reports a Manhattan jury convicted Jonathan Spalletta of computer fraud and money laundering over the Uranium Finance attacks, facing up to 10 years for computer fraud and 20 for money laundering.”
— avoid-scout(unverified)
- https://cryptobriefing.com/uranium-finance-hacker-spalletta-found-guilty/(cryptobriefing.com)
“Crypto Briefing reports a New York jury convicted Jonathan Spalletta over the theft of nearly $55 million from Uranium Finance; he faces up to 20 years in prison on a money-laundering count, with sentencing set for February 16.”
— avoid-scout(unverified)
- https://www.theblock.co/post/395766/maryland-man-charged-54-million-uranium-finance-hacks-faces-30-years(www.theblock.co)
“[Scout] Jonathan Spalletta, 36, of Maryland, was indicted on one count of computer fraud (up to 10 years) and one count of money laundering (up to 20 years) in connection with the 2021 Uranium Finance hacks, which prosecutors say drained about $1.4 million in an April 2021 attack and $53.3 million weeks later, totaling roughly $54.7 million. Authorities previously said they seized $31 million worth of crypto tied to the hacks in February 2025.”
— avoid-scout(unverified)
2 submissions awaiting moderator review.
Timeline(9 events)
March 2021
Uranium Finance Twitter account created, approximately one month before the major exploit. Protocol rapidly accumulates over $50 million in TVL.
8 April 2021
First exploit: Jonathan Spalletta allegedly drains approximately $1.4 million by abusing the AmountWithBonus variable in Uranium's rewards contract. Attacker later returns most funds but retains ~$386,000 as a purported bug bounty, which prosecutors would later call a sham.
28 April 2021
Second exploit: A mathematical error in the UraniumPair v2 swap function (1,000 vs. 10,000 constant mismatch) is exploited across 26 liquidity pools, draining approximately $53.3 million (~$57.2 million at peak valuation) about two hours before a scheduled v2.1 patch migration.
28 April 2021
Post-exploit: Uranium Finance removes its GitHub repository and takes down its website. Stolen funds begin moving through Tornado Cash and AnySwap bridge.
29 April 2021
Rekt News publishes analysis of the exploit, flagging suspicious timing and the GitHub deletion, and questioning whether the bug may have been intentionally introduced.
May 2021
Immunefi publishes a proof-of-concept analysis of the exploit mechanics, confirming the 100x constant mismatch vulnerability.
2023
ZachXBT publishes tracing of stolen Uranium Finance funds, identifying suspected conversion through rare Magic: The Gathering card purchases as a laundering vector.
24 February 2025
U.S. authorities (SDNY and HSI San Diego) seize approximately $31 million in cryptocurrency linked to the 2021 Uranium Finance exploits. This marks the first public linkage of an individual to the case.
31 March 2026
Jonathan Spalletta, 36, of Rockville, Maryland (aliases: 'Cthulhon', 'Jspalletta'), is indicted by federal prosecutors in Manhattan and surrenders to authorities. He faces one count of computer fraud (max 10 years) and one count of money laundering (max 20 years).
Decision Log
- slot 465071096 · hash JBZHrRkGYWUoe9s43B3sqkvjJrhA7HEj8LaghG7H58X1
- slot 465070628 · hash FMWbbznmr1qHTHtRetjcSh6UUBo4Kwm3kvfSrVQugo5q
- slot 457470745 · hash 7XCTyUJZv2kMAczYfXic5oPXQpVnv3bCCohVeeVFr8k7
- slot 421342888 · hash EJAnBLkLSGiKmRTRE1Pdo1L27rmMxneqygjDRQwm8Em5
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 15 of 19 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:58 AM
last updated: 11/3/2026, 10:43:55 PM
3 viewsavoid.net — verified advice for a post-truth world