Crypto Hacker Who Spent Stolen Millions on Pokémon Cards Found Guilty in New York

In April 2021, a flaw in a crypto platform’s code let one man walk off with $53.3 million. He spent part of it on Pokémon cards. On Wednesday, a New York jury called it theft.

Jonathan Spalletta, 36, of Maryland, faces up to 30 years in prison. His lawyers argued he only used tools the platform left open to anyone.

The Bug That Paid Out $53 Million

Uranium Finance was a crypto exchange with no company in charge. Software called a smart contract held users’ coins and paid them out by fixed rules.

On April 8, 2021, Spalletta found a flaw in those rules. He used it repeatedly to collect about $1.4 million he was not owed, the Justice Department said.

Two weeks later, he described it in writing.

“I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway.”

Prosecutors say he then pressured Uranium into letting him keep $386,000 as a “bug bounty,” the reward for reporting flaws. The government called it a sham.

On April 28, he hit a second flaw. He drained about $53.3 million from several pools, and Uranium shut down.

From Crypto Heist to Pokémon Cards

He first ran the money through Tornado Cash, a service that hides where coins came from.

Then he went shopping. A first-edition Pokémon base set cost about $750,000, and a sealed booster box $257,500.

A Black Lotus, a famously rare Magic card, cost $500,000. A Roman coin marking Julius Caesar’s murder cost $601,545.

He also paid $137,500 for a scrap of Wright brothers airplane fabric that Neil Armstrong carried to the moon.

The jury took about two hours to convict, Inner City Press reported. BeInCrypto covered the original March charges.

“As Spalletta’s many victims know, those words could not be further from the truth,” said US Attorney Jamie McDonald in a statement.

Agents seized the Black Lotus and the moon fabric from his home, plus about $31 million in crypto.

The $350 million September Bitget breach ranks as 2026’s largest hack, per DefiLlama data.

A judge will now decide Spalletta’s sentence.