Overview
- Jonathan Spalletta, 36, surrendered in Manhattan on Monday after prosecutors unsealed charges of computer fraud and money laundering that carry up to 30 years in prison.
- The indictment describes two April 2021 attacks that used a rewards‑tracking bug to take about $1.4 million and a single‑character error in withdrawal checks to pull $53.3 million from 26 liquidity pools, which shut down the exchange.
- Authorities say he moved tens of millions through Tornado Cash, a crypto mixer that breaks on‑chain trails, and shifted funds across multiple blockchains to hide their origin.
- Law enforcement recovered about $31 million in cryptocurrency in February 2025 and seized collectibles bought with the proceeds, including a Black Lotus Magic: The Gathering card and a rare Roman Eid Mar coin.
- Prosecutors and experts say the prosecution challenges the ‘code is law’ defense in decentralized finance and could shape future asset recoveries and criminal cases after large smart‑contract exploits.