An alleged hacker has been charged with fraud and money laundering for allegedly exploiting flaws in so-called “smart contracts” that enabled him to defraud a crypto exchange of more than US$50 million.
According to an indictment that was unsealed in a New York court, Jonathan Spalletta (aka Cthulhon and Jspalletta) engaged in computer fraud and money laundering stemming from his alleged hacking of crypto exchange, Uranium Finance.
U.S. authorities alleged that, in April 2021, Spalletta engaged in a series of deceptive transactions to exploit a bug in the exchange’s smart contract that enabled him to generate and withdraw more crypto “rewards” than he was entitled to receive, draining the exchange’s liquidity pool.
Later that same month, he allegedly engaged in a second hack that exploited another error in the smart contract across 26 liquidity pools, which resulted in US$53.3 million being drained from the exchange — ultimately forcing it to shut down.
Those assets were then allegedly laundered through a series of crypto transactions designed to obscure their origin, before being used to purchase a variety of pricey collectibles, including rare Pokémon cards, Magic the Gathering cards, and antique Roman coins.
“As alleged, Jonathan Spalletta repeatedly hacked smart contracts to steal millions of dollars’ worth of other people’s money for himself, and destroyed a cryptocurrency exchange in the process,” said Jay Clayton, U.S. Attorney for the Southern District of New York (SDNY), in a release.
The allegations have not been proven, and he is presumed to be innocent.