‘I did a crypto heist’ | Rockville man buys rare Pokemon, Magic: The Gathering cards after stealing millions in cryptocurrency

A New York jury found Jonathan Spalletta guilty of computer fraud and money laundering for his two hacks of Uranium Finance, which drained the company of funds.

WASHINGTON — A Rockville man who went by “Cthulhon” online was found guilty of hacking a cryptocurrency company and stealing tens of millions of dollars, causing the company to shut down due to lack of funds. He used the money he stole to buy various collectibles, prosecutors said, including rare Pokemon and Magic: The Gathering cards.

This story continues below.

Jonathan Spalletta, 36, was convicted by a jury in New York on one count of computer fraud and one count of money laundering. He’s facing up to 30 years in prison. Prosecutors said he hacked Uranium Finance twice in April 2021, eventually draining the company of funds. Uranium Finance was a decentralized cryptocurrency exchange, prosecutors said, that used liquidity pools to allow people to deposit and exchange money.

According to Spalletta’s own admission in an online message, he exploited a coding flaw to carry out the first hack on April 8, 2021. 

“I did a crypto heist of $1.5MM a couple of weeks ago,” Spalletta wrote in a message to a person about two weeks after the first hack. “There was a bug in a smart contract, and I exploited it. Crypto is all fake internet money anyway.”

He did so by what prosecutors called a “deceptive series of transactions,” that allowed him to withdraw many more “rewards” than he was allowed. Spalletta repeated this so many times that he was able to get almost all of the rewards from a liquidity pool, coming out to about $1.4 million in crypto. 

When Uranium approached him about it, prosecutors said, he extorted the company into letting him keep $386,000 as a “bug bounty” in exchange for returning the rest of the money.

But just weeks later, he did it again. On April 28, 2021, Spalletta exploited another smart-contract flaw related to withdrawal limits. This time, he was able to steal about $53.3 million in crypto across several liquidity pools run by Uranium. That’s when Uranium Finance ran out of funds and had to shut down.

To cover his tracks, prosecutors said he laundered the money through a complex series of transactions and used the cryptocurrency mixer Tornado Cash.

Then, he used the money to buy high-value collectibles. Here are some of the items prosecutors said he bought and how much he spent on them:

A Black Lotus Magic: The Gathering card — approximately $500,00018 sealed Alpha Booster packs — approximately $1.5 millionA first-edition Pokémon booster box — approximately $257,500A complete first-edition Pokémon base set — approximately $750,000A piece of fabric from the Wright brothers’ airplane that later traveled to the moon with Neil Armstrong — approximately $137,500An Eid Mar denarius commemorating the assassination of Julius Caesar — approximately $601,545

On Feb. 24, 2025, federal authorities finally seized $31 million in cryptocurrency tied to the hacks. Spalletta was then indicted in March 2026. 

Officials are asking anyone who believes they may have been affected by the Uranium hack to contact UraniumVictims@hsi.dhs.gov.