Jury convicts Uranium Finance hacker with $31 million of the $53.3 million take already seized

Set the roughly $31 million in crypto seized in February 2025 ^[7] against the roughly $53.3 million drained on April 28, 2021 ^[2], and the seizure covers about 58% of the take ^[17]. Or rather, it is 58% of a 2021 dollar figure measured against a 2025 one, taken 46 months apart ^[18]. Crypto held that long does not keep the dollar value it had on the day it was taken. About $22.3 million of the original figure sits outside the seizure ^[20]. What anyone who lost money in the 26 pools gets back depends on restitution and forfeiture questions that were still open at press time ^[24].

Prosecutors said about $26 million, roughly 49% of the take ^[19], moved through Tornado Cash between April 2021 and November 2023 ^[4]. Blockchain investigator ZachXBT traced millions leaving the mixer in 100 ETH chunks that were converted and spent on collectibles ^[15]. The indictment lists six lots. Among them are a Black Lotus Magic: The Gathering card at about $500,000 and 18 sealed Alpha booster packs at about $1.51 million ^[5], plus a Roman Eid Mar coin at about $601,545 and Wright brothers airplane fabric at about $137,500 ^[6]. All six add up to about $3.76 million ^[13], about 7% of the drain ^[14]. Cards and coins can be physically seized, and agents took the Black Lotus and the fabric along with the crypto ^[7].

The first attack has the odder term. On April 8, 2021, prosecutors said, Spalletta took about $1.4 million through a rewards-distribution flaw and handed back roughly $1 million under what authorities described as a sham bug bounty ^[3]. The roughly $400,000 not returned ^[22] works out to a bounty of about 29% ^[23], priced by the person who took the money. "I did a crypto heist of $1.5MM a couple of weeks ago... There was a bug in a smart contract, and I exploited it... Crypto is all fake internet money anyway," he wrote in a message quoted in the indictment ^[9]. After that first incident he told a Uranium representative, "Get your code audited next time." ^[10]

His lawyers argued at trial that prosecutors could not prove "whose fingers were on the keyboard," that he had not written Uranium's faulty code, and that Tornado Cash was a privacy tool ^[11]. The government answered with blockchain tracing and his own messages, and the jury convicted on both counts ^[12].

Sentencing has no date. The statutory maximums of 10 years for computer fraud and 20 years for money laundering are ceilings ^[8]. After the verdict, Judge Jed S. Rakoff turned down prosecutors' request for GPS monitoring, citing Spalletta's attendance in court ^[16]. Uranium itself was left without funds by the second attack ^[2], so the February 2025 seizure is the only recovered value on the record ^[7].

I think the verdict shows more about tracing than about recovery. A mixer used for 31 months ^[21] did not stop a jury from tying the money to one defendant ^[12]. The opposing reading has weight: about 58% of the dollar take already sits in federal custody, held against a defendant now convicted on both counts ^[17][1]. The test is the restitution order. If it sends most of the seized $31 million to people who lost money in the 26 pools, the case shows prosecution and partial recovery together. If the assets are forfeited without a matching award to those people, the conviction is the whole result ^[24].