CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Exploiter charged for $53.3M Uranium Finance smart contract heist via code flaws and mixer laundering

First reported
Last updated
2 unique sources, 2 articles

Summary

Hide ▲

A Maryland man, Jonathan Spalletta (aka "Cthulhon"), has been charged with orchestrating two smart contract heists against the Uranium Finance decentralized exchange (DEX) in April 2021, stealing approximately $53.3 million in cryptocurrency. The suspect surrendered to law enforcement and appeared in court, where prosecutors alleged he exploited code flaws in Uranium Finance's AMM contracts to drain the exchange's assets, forcing it into insolvency. Proceeds were laundered through Tornado Cash and partially spent on high-value collectibles before law enforcement recovered approximately $31 million in cryptocurrency and seized assets in February 2025. The first breach on April 8, 2021, involved manipulating the AmountWithBonus variable to issue unauthorized zero-token withdrawals, draining about $1.4 million, which he partially extorted back as a sham bug bounty. The second attack on April 28, 2021, exploited a single-character error in transaction-verification logic, allowing him to withdraw 90% of the DEX's assets across 26 liquidity pools while depositing negligible value.

Timeline

  1. 31.03.2026 12:15 2 articles · 1d ago

    Uranium Finance smart contract heists in April 2021 linked to $53.3M theft and subsequent laundering

    Prosecutors allege Jonathan Spalletta surrendered to law enforcement and appeared in court following charges related to the April 2021 attacks. Authorities reiterate that he exploited flaws in Uranium Finance's AMM smart contract code, including a rewards calculation flaw and a transaction-verification logic error, to drain $1.4 million in the first breach and nearly 90% of assets ($53.3 million) across 26 liquidity pools in the second breach. The exchange shut down due to insolvency. Proceeds were laundered via Tornado Cash and partially spent on rare collectibles, including trading cards and an ancient coin. In February 2025, law enforcement seized collectibles from Spalletta's residence and recovered approximately $31 million in cryptocurrency linked to the case. Prosecutorial statements emphasize the impact on the DEX and the legal consequences if convicted.

    Show sources
    Open in new tab

Information Snippets

Similar Happenings

DeFi Exploit Drains $9 Million from Yearn Finance

A critical exploit targeting Yearn Finance's yETH pool on Ethereum has resulted in the theft of approximately $9 million. The attack abused a flaw in the protocol's internal accounting, where a cache containing calculated values to save on gas fees was never cleared when the pool was emptied. The attacker minted an astronomical number of tokens—235 septillion yETH—while depositing only 16 wei, worth approximately $0.000000000000000045. This represents one of the most capital-efficient exploits in DeFi history. The exploit highlights the risks associated with gas optimization techniques in DeFi protocols and the potential for significant financial losses due to unaddressed vulnerabilities.

Open in new tab