New York jury convicts crypto thief who bought Pokémon cards

In April 2021, Jonathan Spalletta exploited a vulnerability in Uranium Finance to steal $53.3 million, using a portion of the money on Pokémon trading cards. A New York jury convicted him of theft this Wednesday.

The 36-year-old Maryland resident now faces a maximum prison sentence of 30 years. His defense argued that he merely used tools made available to all users on the platform.

The Coding Error That Cost $53 Million

Uranium Finance operated as a decentralized exchange without a central corporate entity. A smart contract governed user funds, disbursing them according to predetermined rules.

On April 8, 2021, Spalletta found a loophole in the contract's logic. According to the Justice Department, he repeatedly exploited it to withdraw roughly $1.4 million that was not owed to him.

A fortnight later, he described his actions in a message.

“I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway.”

Prosecutors allege that he then pressured Uranium to allow him to keep $386,000 as a bug bounty—a standard reward for reporting vulnerabilities. Authorities dismissed that claim as a sham.

On April 28, he hit another vulnerability. He drained approximately $53.3 million from several liquidity pools, prompting Uranium to cease operations.

From Digital Theft to Collectible Cards

To disguise the origin of the funds, he first routed them through Tornado Cash, a cryptocurrency mixing service.

He then made purchases. A first-edition Pokémon base set went for about $750,000, and a sealed booster box fetched $257,500.

He also acquired a Black Lotus, an exceedingly rare Magic: The Gathering card, for $500,000. A Roman coin commemorating Julius Caesar's assassination cost $601,545.

He further spent $137,500 on a piece of fabric from the Wright brothers' aircraft that was carried to the moon by Neil Armstrong.

The jury deliberated for about two hours before reaching a guilty verdict, Inner City Press reported. BeInCrypto had previously covered the original March charges.

“As Spalletta’s many victims know, those words could not be further from the truth,” said US Attorney Jamie McDonald in a statement.

Federal agents confiscated the Black Lotus, the moon fabric, and roughly $31 million in cryptocurrency from his home.

According to DefiLlama data, the $350 million Bitget hack in September is the largest security breach of 2026.

Spalletta's sentence will be determined by a judge at a later date.