Jury convicts Uranium Finance hacker with $31 million of the $53.3 million take already seized

Set the roughly $31 million in crypto seized in February 2025 ^[4] against the roughly $53.3 million drained on April 28, 2021 ^[2], and the seizure covers about 58% of the take ^[13]. Or rather, it is 58% of a 2021 dollar figure measured against a 2025 one, taken 46 months apart ^[14]. Crypto held that long does not keep the dollar value it had on the day it was taken. About $22.3 million of the original figure sits outside the seizure ^[17]. What anyone who lost money in the 26 pools gets back depends on restitution and forfeiture questions that were still open at press time ^[24].

Prosecutors said about $26 million, roughly 49% of the take ^[18], moved through Tornado Cash between April 2021 and November 2023 ^[7]. Blockchain investigator ZachXBT traced millions leaving the mixer in 100 ETH chunks that were converted and spent on collectibles ^[12]. The indictment lists six lots. Among them are a Black Lotus Magic: The Gathering card at about $500,000 and 18 sealed Alpha booster packs at about $1.51 million ^[8], plus a Roman Eid Mar coin at about $601,545 and Wright brothers airplane fabric at about $137,500 ^[9]. All six add up to about $3.76 million ^[19], about 7% of the drain ^[20]. Cards and coins can be physically seized, and agents took the Black Lotus and the fabric along with the crypto ^[4].

The first attack has the odder term. On April 8, 2021, prosecutors said, Spalletta took about $1.4 million through a rewards-distribution flaw and handed back roughly $1 million under what authorities described as a sham bug bounty ^[3]. The roughly $400,000 not returned ^[15] works out to a bounty of about 29% ^[16], priced by the person who took the money. "I did a crypto heist of $1.5MM a couple of weeks ago... There was a bug in a smart contract, and I exploited it... Crypto is all fake internet money anyway," he wrote in a message quoted in the indictment ^[5]. After that first incident he told a Uranium representative, "Get your code audited next time." ^[6]

His lawyers argued at trial that prosecutors could not prove "whose fingers were on the keyboard," that he had not written Uranium's faulty code, and that Tornado Cash was a privacy tool ^[10]. The government answered with blockchain tracing and his own messages, and the jury convicted on both counts ^[11].

Sentencing has no date. The statutory maximums of 10 years for computer fraud and 20 years for money laundering are ceilings ^[23]. After the verdict, Judge Jed S. Rakoff turned down prosecutors' request for GPS monitoring, citing Spalletta's attendance in court ^[22]. Uranium itself was left without funds by the second attack ^[2], so the February 2025 seizure is the only recovered value on the record ^[4].

I think the verdict shows more about tracing than about recovery. A mixer used for 31 months ^[21] did not stop a jury from tying the money to one defendant ^[11]. The opposing reading has weight: about 58% of the dollar take already sits in federal custody, held against a defendant now convicted on both counts ^[13][1]. The test is the restitution order. If it sends most of the seized $31 million to people who lost money in the 26 pools, the case shows prosecution and partial recovery together. If the assets are forfeited without a matching award to those people, the conviction is the whole result ^[24].