A federal jury in Manhattan convicted a cryptocurrency hacker on Oct. 7 of draining a decentralized exchange of more than $50 million — and the list of what he bought with it runs through a Magic: The Gathering Black Lotus, 18 sealed Alpha Booster packs and two Pokémon lots.

Jonathan Spalletta, 36, of Rockville, Maryland, was convicted of one count of computer fraud and one count of money laundering after a six-day trial before U.S. District Judge Jed S. Rakoff, the U.S. Attorney's Office for the Southern District of New York said in a release dated Oct. 7, 2026. The office says he was convicted on all counts of the indictment.

No sentence has been imposed. The two counts carry statutory maximums of 10 years and 20 years in prison respectively — figures the office notes are prescribed by Congress and provided for information only, because sentencing is the court's to determine. Quartz, reporting the verdict from Bloomberg, says Rakoff set sentencing for Feb. 16 and that the jury reached its verdict after roughly two hours of deliberation.

What the office says happened

Uranium Finance was a decentralized cryptocurrency exchange where users deposited and swapped currencies through liquidity pools. According to the indictment, public filings and the evidence presented at trial, Spalletta carried out two separate hacks in April 2021.

  • April 8, 2021 — a deceptive series of transactions with the exchange's smart contract withdrew far more in "rewards" than he was authorised to receive, repeated "over and over until he had drained the liquidity pool of nearly all its rewards tokens," for a total of approximately $1.4 million.
  • April 28, 2021 — an error in the smart contract governing how much could be withdrawn from a liquidity pool, exploited across multiple separate pools, produced approximately $53.3 million and caused Uranium to shut down "due to lack of funds."

The office says the proceeds were then laundered through a complex series of cryptocurrency transactions including the mixer Tornado Cash. It also describes a sham: two weeks after the first hack, per the release, Spalletta told another person in writing, "I did a crypto heist of $1.5MM a couple of weeks ago . . . There was a bug in a smart contract, and I exploited it . . . Crypto is all fake internet money anyway." The office says he then extorted Uranium into letting him keep approximately $386,000 of the stolen money as a sham "bug bounty" in exchange for returning the remainder.

Where the cards come in

After laundering the funds, the office says, Spalletta used the money to buy personal collectable items. The release itemises them, and its four card lots come to $3.02 million:

  • a "Black Lotus" Magic card — approximately $500,000
  • 18 packs of sealed "Alpha Booster" Magic cards — approximately $1,512,500
  • one sealed box of first edition "Booster" Pokémon cards — approximately $257,500
  • one first edition complete base set of Pokémon cards — approximately $750,000

Two non-card purchases sit in the same list: a Roman "Eid Mar Denarius," a coin commemorating the assassination of Julius Caesar, at approximately $601,545, and a piece of fabric from the original Wright brothers' airplane that astronaut Neil Armstrong carried to the surface of the moon on the first landing, at approximately $137,500.

The office released photographs of some of the seized property — the Black Lotus, the Wright fabric and certain of the coins, all seized from Spalletta's residence under a judicially authorised search warrant. The card photograph shows a crate of graded slabs carrying a Heritage Auctions lot label reading "Auction # 7323 / Lot # 36014," whose description line names an Artist Proof Black Lotus (Beta) in a CGC holder.

Separately, the office says law enforcement seized cryptocurrency worth approximately $31 million at the time of seizure on Feb. 24, 2025, under a judicially authorised seizure warrant.

What the case is, and is not

The two counts are computer fraud and money laundering. The cards are where part of the proceeds went, not what was taken from Uranium, and no count in the case concerns a card transaction. The purchase figures are the office's account of what Spalletta paid, not market values and not appraisals of the property.

Analysis: the notable thing for a card audience is not that someone convicted of fraud bought collectables — it is how much of the itemised spending went to cards. Of roughly $3.76 million in purchases the release lists, $3.02 million is cards: a 1993-era Magic: The Gathering icon and two Pokémon lots that now share a paragraph with a moon-flown scrap of a Wright Flyer and a denarius struck after Caesar's murder. The pictured slab also carries a Heritage Auctions lot label, so at least one of the cards came through the same auction channel collectors use.

Sources: every figure attributed to the office, the quoted written message and the photograph description come from the U.S. Attorney's Office for the Southern District of New York release "Jonathan Spalletta Convicted For Defrauding Crypto Exchange Of Over $50 Million In Hacks," dated Oct. 7, 2026 (press release number 26-285). The deliberation time and the Feb. 16 sentencing date come from Quartz, which attributes both to Bloomberg. Decrypt independently reports the charges, the six-day trial, the two statutory maximums, the $386,000 sham bug bounty and the same purchase list. The $3.02 million card total is this blog's arithmetic on the office's itemised figures; no source publishes that sum, and the same goes for the $3.76 million total of the itemised purchases. Passages marked "Analysis" are this blog's interpretation, not findings in the release.