A New York jury found a cybersecurity consultant guilty of stealing nearly $55 million in cryptocurrency and blowing part of it on rare trading cards, underscoring how digital theft hits real families and small investors.
Story Highlights
- A Manhattan jury convicted Jonathan Spalletta of computer fraud and money laundering tied to two 2021 attacks on Uranium Finance.
- Prosecutors said he routed stolen funds through Tornado Cash before buying rare Pokémon and Magic: The Gathering cards.
- Authorities seized more than $3 million in collectible cards and about $31 million in cryptocurrency from a Maryland home.
- The verdict came after just over two hours of jury deliberation, reflecting a clear rejection of the defense theory.
Jury Verdict Ties Two Crypto Attacks to a Single Defendant
Bloomberg reported that a New York jury convicted Maryland cybersecurity consultant Jonathan Spalletta after just over two hours of deliberation, finding he stole nearly $55 million from Uranium Finance in 2021. Prosecutors said the theft came from two attacks that drained the decentralized exchange and forced it to shut down. The Justice Department later said the scheme exploited vulnerabilities across multiple liquidity pools and caused losses of about $53.3 million. The jury returned guilty verdicts for computer fraud and money laundering.
Prosecutors described how the theft moved from code to cash-like goods. Reports say Spalletta laundered the proceeds through Tornado Cash, a crypto “mixer” used to hide where funds came from, and then spent some of the money on rare collectibles. Outlets detailed purchases that included a high-end Black Lotus card and sealed Alpha Magic: The Gathering booster packs. This spending narrative helped jurors see a simple arc: exploit, conceal, and convert into items that can be stored or resold.
Seizures Reveal Cards-and-Crypto Cache After the Heist
Investigators seized more than $3 million in rare Pokémon and Magic: The Gathering cards from a Maryland residence linked to Spalletta, along with about $31 million in cryptocurrency, according to Bloomberg’s account of the case. That search added weight to the government’s claim that stolen tokens funded luxury purchases. Coverage also noted detailed purchase figures presented at trial, such as about $500,000 for a Black Lotus card and about $1.51 million for sealed Alpha packs, which are prized by collectors.
The government said the chain from the exploit to the shopping spree ran through the Tornado Cash service. Reporting on this case and related enforcement actions shows why that matters: the Department of Justice has charged Tornado Cash’s founders for enabling over a billion dollars in laundering, including for sanctioned groups, placing mixers squarely in prosecutors’ sights. By showing stolen funds passed through a mixer and then into tangible assets, the case fit a pattern that juries can follow even when the code is complex.
Defense Argued “No Hack,” but Jury Rejected the Claim
The defense told jurors that Spalletta used public smart-contract functions and did not defeat access controls. Counsel said the government could not prove “whose fingers were on the keyboard” or that the same crypto funded the card buys. That argument aimed at attribution, not whether a bug existed. The jury’s quick verdict signaled that testimony and tracing evidence convinced them the defendant both executed the drain and laundered the proceeds. Spalletta pleaded not guilty before trial, as is standard.
A cybersecurity consultant, a guy literally paid to find and fix vulnerabilities, just got convicted of draining $50M+ from a crypto exchange he was never hired to protect, then blowing part of it on rare trading cards. The scary skill set and the protective skill set are the…
— Nacho AF CMO (@IgnacioAFCMO) October 9, 2026
This conviction carries lessons for honest crypto users and for law and order. First, high-tech crime still leaves tracks. Blockchain moves live on public ledgers, and even mixers may not hide the story when agents pair on-chain analysis with search warrants and seizures. Second, complex scams hurt real people. When platforms fail, retail investors and small businesses often eat the loss. That is why strong enforcement protects market fairness and deters predators who treat code like a license to steal.
Sources:
bloomberg.com, gizmodo.com, news.bitcoin.com, news.bloomberglaw.com, ground.news, crypto.news, mitrade.com