Black Lotus, Pokémon, and One Costly "Fake Internet Money" Heist 🃏

A Manhattan federal jury has convicted Jonathan Spalletta, 36, of Rockville, Maryland, on charges of computer fraud and money laundering tied to two 2021 exploits of decentralized exchange Uranium Finance that prosecutors said netted more than $50 million and forced the platform to shut down. Spalletta was found guilty on all counts following a six-day trial before U.S. District Judge Jed S. Rakoff, and faces up to 10 years in prison for computer fraud and up to 20 years for money laundering at sentencing. He had been charged in March.

In the first exploit, on April 8, 2021, Spalletta repeatedly called Uranium Finance's smart contract to withdraw far more rewards than he was entitled to, extracting about $1.4 million. Prosecutors said he then pressured the project into letting him keep roughly $386,000 as what they described as a sham "bug bounty" in exchange for returning the remainder. Two weeks later, in a message to another person, Spalletta wrote, "I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway."

On April 28, 2021, Spalletta exploited an error in how the contract calculated withdrawals across several liquidity pools, draining about $53.3 million and leaving the exchange without enough funds to operate. "Spalletta's crimes cost real people to lose real money—over $50 million dollars—and caused an entire crypto platform to collapse," U.S. Attorney Jamie McDonald said. The U.S. Attorney's Office for the Southern District of New York said prosecutors and agency partners had done "outstanding work to ensure Spaletta's virtual world criminal conduct ended in his real-world criminal conviction."

Prosecutors said Spalletta laundered the proceeds through a series of transactions, including the coin mixer Tornado Cash, and used the funds to buy high-value collectibles. His purchases included a Black Lotus Magic: The Gathering card for about $500,000, 18 sealed packs of Alpha Booster cards for about $1.5 million, a first edition complete Pokémon base set for about $750,000, a sealed box of first edition Pokémon booster packs for about $257,500, an Eid Mar denarius Roman coin commemorating the assassination of Julius Caesar for about $601,545, and a piece of fabric from the Wright brothers' original airplane that Neil Armstrong carried to the moon for about $137,500.