A Maryland cybersecurity consultant who allegedly stole nearly US$55mil (RM224.37mil) in hacked cryptocurrency and spent some of it on rare Pokémon and Magic: The Gathering cards went on trial in New York.
Jonathan Spalletta was charged in March with two 2021 hacks of cryptocurrency exchange Uranium Finance, which allegedly shut down as a result. Opening statements in the case began on Sept 28 in Manhattan federal court. Spalletta, who has pleaded not guilty, faces a maximum of 20 years in prison if convicted of the most serious charge against him.
Addressing the jury, federal prosecutor Shaun Werbelow said Spalletta "orchestrated a plan to destroy a whole cryptocurrency platform, to steal US$50mil (RM203.97mil) and then launder the money he stole.”
Defence lawyer Shrey Sharma conceded that Spalletta interacted with Uranium but denied that he hacked the platform, arguing that he didn’t use spoofed credentials or malicious code to bypass any access control system. Sharma said he used publicly available functions built into the exchange’s smart contracts – computer programs that automatically execute transactions when predetermined conditions are met.
The case has attracted some attention because of the collectables Spalletta allegedly bought with the hacks’ proceeds. The government seized from his Rockville residence more than US$3mil (RM12.24mil) worth of rare cards from the Magic: The Gathering and Pokémon games. The value of such cards has increasingly made them targets of crime.
Spalletta also allegedly spent more than US$600,000 (RM2.45mil) on a Roman coin commemorating the assassination of Julius Caesar and US$137,500 (RM590,917) for a piece of fabric from the Wright Brothers' original aeroplane that Neil Armstrong took with him to the moon. Authorities seized those collectables along with US$31mil (RM126.46mil) in crypto.
Sharma disputed the government’s suggestion that Spalletta hacked Uranium to fund his collectable purchases, noting the latter started in 2023. There is no proof that "the cryptocurrency from Uranium Finance is the same cryptocurrency that was used to make these purchases,” the defence lawyer said.
The trial comes amid a recent wave of crypto hacks, which have remained a persistent threat even as the industry has pushed deeper into mainstream finance. Crypto exchange Bitget said on Sept 25 that hackers stole about US$357mil (RM1.46bil), weeks after Bitcoin sidechain Liquid Network disclosed a roughly US$320mil (RM1.31bil) theft.
Prosecutors say that, in the first of his two hacks, Spalletta used a deceptive series of transactions to fool Uranium, which paid crypto as a bonus to users who made deposits into the liquidity pools, to grant him more rewards than he was entitled to receive. He repeated the transactions until he had drained the entire reward pool, extracting crypto worth about US$1.4mil (RM5.71mil) at the time, according to the government.
Spalletta allegedly bragged about the hack in an email a few weeks later and then extorted Uranium into allowing him to keep US$386,000 (RM1.57mil) of the crypto as a "bug bounty,” a reward for finding vulnerabilities in its software.
"Get your code audited next time,” Spalletta told a Uranium representative after he received the payment, according to the indictment.
Just three weeks later, prosecutors say, Spalletta found an exploit that regulated how much he could withdraw from a pool and used it to obtain crypto worth more than US$53.3mil (RM217.43mil) at the time. That allegedly caused Uranium to shut down due to lack of funds.
Spalletta then allegedly laundered the proceeds of the hack through a series of transactions, using services such as the cryptocurrency mixer Tornado Cash, the co-founder of which was convicted of running an unlicensed money-transfer operation last August. – Bloomberg
