Uranium Finance hacker convicted over cryptocurrency theft

Jonathan Spalletta, a 36-year-old Maryland man, was found guilty after hacking cryptocurrency exchange Uranium Finance twice in April 2021, BleepingComputer reported. The theft forced the exchange to shut down for lack of funds. The first attack exploited a flaw in software governing withdrawals to collect rewards without depositing tokens. A later attack exploited a separate verification error that used 1,000 instead of 10,000, allowing him to withdraw nearly 90% of assets in the exchange's liquidity pools while depositing effectively zero tokens. Spalletta laundered proceeds through Tornado Cash and decentralized exchanges. He faces up to 10 years in prison for computer fraud and up to 20 years for money laundering.