Uranium crypto exchange hacker convicted for stealing $53 million

In April 2021, Jonathan Spalletta exploited two distinct flaws in Uranium Finance's smart contract code. The first exploit allowed him to issue zero-token withdrawal commands, draining approximately $1.4 million from the liquidity pool. After extorting a sham bug bounty, he returned for a second attack, exploiting a transaction-verification logic error that used 1,000 instead of 10,000 as a divisor, enabling him to withdraw nearly 90% of the exchange's liquidity pools while depositing effectively zero tokens. This second exploit netted about $53.3 million, forcing Uranium Finance to shut down. Spalletta laundered the stolen funds through Tornado Cash and decentralized exchanges, spending part on expensive collectibles. Law enforcement seized assets and recovered roughly $31 million. He was charged with computer fraud and money laundering.

The attacker stole over $53 million in cryptocurrency, causing Uranium Finance to shut down due to lack of funds. The theft resulted in significant financial losses for users and the platform. The laundering of stolen funds complicated recovery efforts. Approximately $31 million was recovered by law enforcement. The incident demonstrates the severe financial and operational impact of smart contract vulnerabilities in decentralized finance platforms.

No specific patch or remediation information is provided for the vulnerabilities exploited. Users and operators of decentralized finance platforms should ensure thorough smart contract audits to identify and fix logic errors, particularly in withdrawal and transaction verification functions. Since Uranium Finance shut down after the incident, no direct remediation is available for this platform. Monitoring for suspicious activity and employing multi-layer security controls in smart contract design are recommended to prevent similar exploits.