Spalletta convicted as DOJ files [ticker USDC], [ticker USDT] forfeiture cases

Jonathan Spalletta — online handles “Cthulhon” and “Jspalletta” — was convicted of computer fraud and money laundering after a six-day jury trial. The underlying conduct involved two hacks of decentralized cryptocurrency exchange Uranium Finance. The U.S. Attorney’s Office for the Southern District of New York’s announcement says the jury found him guilty on every count in the indictment before U.S. District Judge Jed S. Rakoff.

Two civil forfeiture cases, both filed October 7, 2026, accompanied the verdict. One targets approximately 144,986.63 UUSDC$0.9997▼0.02%, valued at approximately $144,966.77, per the N.D.W. Va. case listing. The other names all UUSDT$0.9996▼0.03% held at a specified cryptocurrency address, but the filing does not disclose the amount, per a separate S.D.N.Y. case. These are forfeiture proceedings, not completed forfeiture judgments.

Two hacks, one conviction

The first hack came on April 8, 2021. Spalletta extracted cryptocurrency worth approximately $1.4 million, then extorted the project into letting him keep roughly $386,000 of that as a supposed “bug bounty,” according to the U.S. Attorney’s Office.

Twenty days later, on April 28, 2021, he hit Uranium Finance again and took approximately $53.3 million. The platform shut down after that second attack. The April 28 haul was roughly 97.3% of the combined $54.7 million total — $53.3 million divided by $54.7 million, multiplied by 100.

Spalletta then ran the proceeds through a string of cryptocurrency transactions including the mixer Tornado Cash. He also spent heavily on collectibles: a Black Lotus Magic: The Gathering card for approximately $500,000, 18 packs of sealed Alpha Booster Magic cards for approximately $1.5125 million, one sealed box of first edition “Booster” Pokémon Cards for approximately $257,500, a first-edition complete base set of Pokémon cards for approximately $750,000, fabric from the original Wright brothers’ airplane for approximately $137,500, and an Eid Mar Denarius antique coin for approximately $601,545.

His own words, as quoted by the U.S. Attorney’s Office, frame how he saw it: “I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway.”

The jury convicted him on both counts. U.S. Attorney Jamie McDonald said, “As a unanimous Manhattan jury has found, Jonathan Spalletta repeatedly exploited vulnerabilities in the code of a decentralized cryptocurrency platform to steal tens of millions of dollars.”

What the new forfeiture cases establish

Law enforcement seized cryptocurrency worth approximately $31 million on February 24, 2025 — 590 days before the October 7, 2026 conviction. The U.S. Attorney’s Office described those assets as fraudulently obtained by Spalletta.

CoinGecko listed USDT at $0.99954 and USDC at $0.999709 as of October 7, 2026. Those prices don’t change the legal status of either asset, and the USDT proceeding still lacks a disclosed token amount.

Spalletta, 36, of Rockville, Maryland, faces a maximum of 10 years for computer fraud and 20 years for money laundering. The fact sheet does not provide a sentencing date. Assistant U.S. Attorneys Kevin Mead, William C. Kinder, and Shaun Werblow of the Office’s Complex Frauds and Cybercrime Unit are prosecuting.