Priya Nadkarni
Boston, MA
Oct 9, 2026

The difference between discovering a software vulnerability and stealing through it is not a matter of terminology. Calling a payment a “bug bounty” does not establish permission to take funds—or turn a demand for compensation into an authorized security engagement.

That distinction sits at the center of the federal prosecution of Jonathan Spalletta over attacks on Uranium Finance, a decentralized cryptocurrency exchange. According to a Justice Department announcement dated October 7, 2026, a jury convicted Spalletta of computer fraud and money laundering after prosecutors accused him of exploiting the exchange’s smart contracts to take more than $50 million in digital assets.

The department identified Spalletta as a cybersecurity consultant who used the aliases “Cthulhon” and “Jspalletta.” Prosecutors said he exploited vulnerabilities in contracts governing Uranium Finance’s liquidity pools, demanded an unauthorized bounty and laundered proceeds through Tornado Cash. Those details describe the government’s theory of the case; the announced convictions are for computer fraud and money laundering, not a separately identified extortion count.

For the decentralized-finance industry, the consequential question is not whether software can contain exploitable flaws. It is whether a person’s interaction with that software was authorized, and what happened to assets belonging to others.

Code execution is not necessarily legal permission

Smart contracts make transactions possible without the discretionary approval of a bank employee or exchange operator. But a transaction’s successful execution does not, by itself, answer whether the person initiating it had legal authority to obtain the resulting assets. Technical capability and legal permission are different questions.

That distinction also limits what can responsibly be inferred from the verdict. A jury’s conviction resolves the charged offenses against a particular defendant on the evidence presented. It does not establish that every unexpected interaction with a smart contract constitutes computer fraud, or that every contentious bounty negotiation is criminal.

Without the trial record and jury instructions, the announcement alone cannot establish precisely how prosecutors proved the relevant elements or how authorization was presented to the jury. That matters for anyone hoping to treat the case as a broad rule governing permissionless software. A criminal verdict is not a substitute for examining the statute, the instructions and the conduct at issue.

The narrower commercial lesson is clearer. Publicly accessible code is not an open-ended invitation to conduct testing that puts customer assets at risk. A protocol’s willingness to receive vulnerability reports does not necessarily authorize a researcher to withdraw funds first and negotiate afterward.

What makes a bounty legitimate

A formal bug-bounty program establishes a relationship before a dispute arises. Its terms can identify eligible contracts, permitted testing methods, reporting requirements and the conduct covered by any promise not to pursue legal action. Those boundaries help distinguish a sanctioned investigation from an intrusion dressed in the language of security research.

Prosecutors described Spalletta’s demand as an unauthorized bounty. The important issue is not simply that he sought payment, but that the government tied the demand to the taking of digital assets. Discovering a flaw, demonstrating it within agreed limits and reporting it are materially different acts from taking control of someone else’s funds and using their return as negotiating leverage.

DeFi projects face practical complications here. A protocol may have no conventional security department, its governance may be dispersed, and administrators may have limited power to stop a live exploit. Those constraints make explicit authorization more valuable, not less: researchers need to know who can approve testing, while teams need a reliable channel for urgent disclosures.

Following the proceeds beyond the blockchain

The property seizures described by prosecutors show another dimension of the investigation. Authorities said they recovered approximately $31 million in cryptocurrency and collectibles purchased with stolen proceeds, including a Black Lotus Magic: The Gathering card valued at $500,000, sealed first-edition Pokémon card sets, Roman Eid Mar coins and fabric from the Wright brothers’ aircraft that traveled aboard Apollo 11.

The inventory illustrates how stolen digital value can move into physical markets. It does not, on its own, show the tracing evidence connecting each purchase to the exploit. That connection is important: the government’s assertion that an object was acquired with criminal proceeds must rest on evidence, not merely on the owner’s possession of an expensive collectible.

The same care applies to Tornado Cash. Prosecutors said Spalletta used the mixer to launder proceeds, but using privacy technology is not, standing alone, proof of money laundering. The legal analysis depends on the source of the funds, the transactions and the knowledge and intent required by the charged offense.

Blockchain systems can create useful new ways to exchange and manage assets. They do not eliminate the need to distinguish authorized activity from asset taking, or legitimate disclosure from coercive demands. Uranium Finance’s case puts that boundary in concrete terms: a “bug bounty” label cannot settle the legal character of the conduct that preceded it.

Source note: The reported verdict and seizure details above are based on the supplied text of the linked DOJ announcement. The announcement and underlying trial record were not independently verified; the supplied material does not establish sentencing details or the status of any appeal.