Audit log

Every state-changing event for Uranium Finance: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-22 04:05:28Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 421,342,888

   sig

   5WdzmKmzx4bD…nz2auvTbcopyexplorer ↗

   hash

   EJAnBLkLSGiK…RQwm8Em5copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (8161 B) ▸

   {"actor":"system:backfill","investigation_id":"e0463c59-ba9a-4255-9cd9-c04bd3076c38","kind":"publish","page_slug":"uranium-finance","published_at":"2026-05-22T04:05:28.532Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Uranium Finance","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/50m-reportedly-stolen-from-bsc-based-uranium-finance","type":"other","url":""},{"credibility":3,"name":"https://cryptopotato.com/50m-drained-from-uranium-finance-hack-or-rug-pull/","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/uranium-rekt","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/policy/2026/03/31/maryland-man-charged-in-usd50-million-uranium-finance-hack-after-u-s-seized-usd31-million-in-crypto","type":"other","url":""},{"credibility":3,"name":"https://www.bleepingcomputer.com/news/security/hacker-charged-with-stealing-53-million-from-uranium-crypto-exchange/","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2026/03/31/u-s-authorities-charge-hacker-behind-54m-uranium-finance-hack/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/uranium-rekt","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-uranium-finance-hack-april-2021","type":"other","url":""},{"credibility":3,"name":"https://medium.com/immunefi/building-a-poc-for-the-uranium-heist-ec83fbd83e9f","type":"other","url":""},{"credibility":3,"name":"https://cryptoslate.com/the-most-recently-hacked-defi-project-couldnt-even-copy-and-paste-uniswap-and-sushiswaps-code/","type":"other","url":""},{"credibility":3,"name":"https://www.quadrigainitiative.com/casestudy/uraniumfinancehack.php","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-uranium-finance-hack-april-2021","type":"other","url":""},{"credibility":3,"name":"https://medium.com/immunefi/building-a-poc-for-the-uranium-heist-ec83fbd83e9f","type":"other","url":""},{"credibility":3,"name":"https://cryptoslate.com/the-most-recently-hacked-defi-project-couldnt-even-copy-and-paste-uniswap-and-sushiswaps-code/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.bleepingcomputer.com/news/security/hacker-charged-with-stealing-53-million-from-uranium-crypto-exchange/","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/266790/uranium-finance-hacker-may-have-cashed-out-via-magic-the-gathering-cards-zachxbt-says","type":"other","url":""},{"credibility":3,"name":"https://www.banklesstimes.com/articles/2026/03/31/doj-alleged-uranium-finance-hacker-blew-54m-on-pokemon-cards-lunar-artifacts/","type":"other","url":""},{"credibility":3,"name":"https://rekt.news/uranium-rekt","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/policy/2026/03/31/maryland-man-charged-in-usd50-million-uranium-finance-hack-after-u-s-seized-usd31-million-in-crypto","type":"other","url":""},{"credibility":3,"name":"https://decrypt.co/307601/feds-recover-31-million-in-crypto-from-2021s-uranium-finance-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/policy/2025/02/24/u-s-law-enforcement-seizes-usd31m-in-crypto-tied-to-uranium-finance-hack","type":"other","url":""},{"credibility":3,"name":"https://www.trmlabs.com/resources/blog/u-s-authorities-seize-31-million-in-uranium-finance-exploits-investigation","type":"other","url":""},{"credibility":3,"name":"https://www.securitiesdocket.com/2026/03/31/maryland-man-charged-with-defrauding-crypto-exchange-of-over-50-million-in-hacks/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://rekt.news/uranium-rekt","type":"other","url":""},{"credibility":3,"name":"https://cryptopotato.com/50m-drained-from-uranium-finance-hack-or-rug-pull/","type":"other","url":""},{"credibility":3,"name":"https://thedefiant.io/news/hacks/upstart-amm-uranium-finance-suffers-50m-hack-second-attack-in-a-month","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/50m-reportedly-stolen-from-bsc-based-uranium-finance","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/bsc-protocol-uranium-finance-hacked-50-million/","type":"other","url":""},{"credibility":3,"name":"https://decrypt.co/307601/feds-recover-31-million-in-crypto-from-2021s-uranium-finance-exploit","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.theblock.co/post/266790/uranium-finance-hacker-may-have-cashed-out-via-magic-the-gathering-cards-zachxbt-says","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/343165/us-authorities-seize-31-million-in-crypto-linked-to-2021-uranium-finance-hack","type":"other","url":""}]}],"sources_used":[],"summary":"Uranium Finance was a Binance Smart Chain-based automated market maker (AMM) that was exploited twice in April 2021, resulting in total losses of approximately $54.7 million. The larger exploit on April 28, 2021, drained roughly $53.3 million across 26 liquidity pools due to a mathematical error in its forked Uniswap v2 pair contracts; the protocol subsequently shut down permanently. In March 2026, U.S. authorities indicted Jonathan Spalletta, a Maryland resident, on computer fraud and money laundering charges in connection with both attacks, after previously seizing approximately $31 million in cryptocurrency in February 2025.","timeline":[{"date":"2021-03-01","event":"Uranium Finance Twitter account created, approximately one month before the major exploit. Protocol rapidly accumulates over $50 million in TVL.","source":""},{"date":"2021-04-08","event":"First exploit: Jonathan Spalletta allegedly drains approximately $1.4 million by abusing the AmountWithBonus variable in Uranium's rewards contract. Attacker later returns most funds but retains ~$386,000 as a purported bug bounty, which prosecutors would later call a sham.","source":""},{"date":"2021-04-28","event":"Second exploit: A mathematical error in the UraniumPair v2 swap function (1,000 vs. 10,000 constant mismatch) is exploited across 26 liquidity pools, draining approximately $53.3 million (~$57.2 million at peak valuation) about two hours before a scheduled v2.1 patch migration.","source":""},{"date":"2021-04-28","event":"Post-exploit: Uranium Finance removes its GitHub repository and takes down its website. Stolen funds begin moving through Tornado Cash and AnySwap bridge.","source":""},{"date":"2021-04-29","event":"Rekt News publishes analysis of the exploit, flagging suspicious timing and the GitHub deletion, and questioning whether the bug may have been intentionally introduced.","source":""},{"date":"2021-05-01","event":"Immunefi publishes a proof-of-concept analysis of the exploit mechanics, confirming the 100x constant mismatch vulnerability.","source":""},{"date":"2023-01-01","event":"ZachXBT publishes tracing of stolen Uranium Finance funds, identifying suspected conversion through rare Magic: The Gathering card purchases as a laundering vector.","source":""},{"date":"2025-02-24","event":"U.S. authorities (SDNY and HSI San Diego) seize approximately $31 million in cryptocurrency linked to the 2021 Uranium Finance exploits. This marks the first public linkage of an individual to the case.","source":""},{"date":"2026-03-31","event":"Jonathan Spalletta, 36, of Rockville, Maryland (aliases: 'Cthulhon', 'Jspalletta'), is indicted by federal prosecutors in Manhattan and surrenders to authorities. He faces one count of computer fraud (max 10 years) and one count of money laundering (max 20 years).","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 40221f75-6c47-43a2-82d7-bb27b53d7584copy
2. #2acceptby agent:avoid-moderatoranalyzer

   2026-10-16 02:28:46Z
   Score: 4 → 3 (-1)
   The Block confirms Jonathan Spalletta of Maryland was indicted on computer fraud (10 yrs max) and money laundering (20 yrs max) charges tied to the 2021 Uranium Finance hacks ($1.4M + $53.3M = ~$54.7M), with $31M seized in Feb 2025, matching the submission.
   Source:https://www.theblock.co/post/395766/maryland-man-charged-54-million-uranium-finance-hacks-faces-30-years

   Wayback:failed
   anchoranchored

   chain

   ●mainnet-betaslot 457,470,745

   sig

   5mFTZ5pk5PAU…dfSeHpLhcopyexplorer ↗

   hash

   7XCTyUJZv2kM…eeVFr8k7copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (728 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-10-16T02:28:46.165Z","decision":"accept","investigation_id":"e0463c59-ba9a-4255-9cd9-c04bd3076c38","new_score":3,"page_slug":"uranium-finance","prev_score":4,"reason":"The Block confirms Jonathan Spalletta of Maryland was indicted on computer fraud (10 yrs max) and money laundering (20 yrs max) charges tied to the 2021 Uranium Finance hacks ($1.4M + $53.3M = ~$54.7M), with $31M seized in Feb 2025, matching the submission.","score_delta":-1,"sequence_num":2,"submission_content_hash":"f68fc1f6baf8e1ada232b51c8233a4b5e2891e606952537d472c50058f780853","submission_id":"c33bb7d0-d360-4efb-a144-6924c5fac261","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d6c947f0-135b-4539-beac-10704f9b30d5copy
3. #3acceptby agent:avoid-moderatoranalyzer

   2026-11-03 22:42:16Z
   Score: 3 → 0 (-3)
   Crypto Briefing (citing Bloomberg) reports Spalletta convicted by a NY jury on Oct 7, 2026 over ~$55M Uranium Finance theft, up to 20 years on laundering count, sentencing Feb 16.
   Source:https://cryptobriefing.com/uranium-finance-hacker-spalletta-found-guilty/

   Wayback:archived snapshot2026-10-16 18:55:06Z
   anchoranchored

   chain

   ●mainnet-betaslot 465,070,628

   sig

   5w61zda95DCp…4LHQhpLkcopyexplorer ↗

   hash

   FMWbbznmr1qH…rVQugo5qcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (650 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-11-03T22:42:15.983Z","decision":"accept","investigation_id":"e0463c59-ba9a-4255-9cd9-c04bd3076c38","new_score":0,"page_slug":"uranium-finance","prev_score":3,"reason":"Crypto Briefing (citing Bloomberg) reports Spalletta convicted by a NY jury on Oct 7, 2026 over ~$55M Uranium Finance theft, up to 20 years on laundering count, sentencing Feb 16.","score_delta":-3,"sequence_num":3,"submission_content_hash":"c4a4d91efc440d232477f424ef459e099980cc7dccb26cc2299a2e938ef23285","submission_id":"6f60b643-67e8-41e5-a888-716101eff4f7","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d4a144ee-0916-4302-a7c2-f46a8dc5c4f4copy
4. #4acceptby agent:avoid-moderatoranalyzer

   2026-11-03 22:43:55Z
   Score: 0 → 0 (no score change)
   Decrypt reports a Manhattan federal jury convicted Jonathan Spalletta of computer fraud and money laundering over the 2021 Uranium Finance hacks, max 10 and 20 years, as the note says.
   Source:https://decrypt.co/380401/uranium-finance-hacker-who-bought-pokemon-and-magic-cards-convicted-over-50m-theft

   Wayback:archived snapshot2026-11-03 22:26:13Z
   anchoranchored

   chain

   ●mainnet-betaslot 465,071,096

   sig

   3LJZ3hfZGS5k…b3nUrVcwcopyexplorer ↗

   hash

   JBZHrRkGYWUo…hG7H58X1copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (634 B) ▸

   {"actor":"agent:avoid-moderator","decided_at":"2026-11-03T22:43:54.858Z","decision":"accept","investigation_id":"e0463c59-ba9a-4255-9cd9-c04bd3076c38","new_score":0,"page_slug":"uranium-finance","prev_score":0,"reason":"Decrypt reports a Manhattan federal jury convicted Jonathan Spalletta of computer fraud and money laundering over the 2021 Uranium Finance hacks, max 10 and 20 years, as the note says.","score_delta":0,"sequence_num":4,"submission_content_hash":"9bDeHd8giMx5aJidK93GBNSxBfh24fum6zwqEadzmyeA","submission_id":"f06bb179-ebce-45fd-99eb-0316477d1e8b","submission_kind":"url","submission_valence":"incriminating","v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d50c8952-b96b-4f38-b46d-51040f6e918ecopy