Prosecutors say a convicted crypto hacker spent about $3M on Magic and Pokémon cards

On October 7, a federal jury in Manhattan convicted Jonathan Spalletta, 36, of Rockville, Maryland, of computer fraud and money laundering after a six-day trial, the US Attorney's Office for the Southern District of New York announced. Prosecutors say he took more than $50 million from the crypto platform Uranium Finance in 2021, laundered it, and spent part of it on some of the most expensive cards in the hobby (SDNY).

The six collectibles on the prosecutors' list

The release lists the items he bought with the proceeds, at approximate prices:

The four card items add up to $3,020,000, about 80% of the $3,759,045 in collectibles the release names (our arithmetic from the release's figures). Sealed product is the largest share: the Alpha packs and the Pokémon box together come to $1,770,000, and the 18 packs average about $84,000 each.

How the money left Uranium Finance

The release describes two hacks. On April 8, 2021, Spalletta exploited a Uranium smart contract to withdraw about $1.4 million in rewards he wasn't entitled to, kept about $386,000 as what prosecutors call a sham "bug bounty," and returned the rest. On April 28, 2021, he exploited a withdrawal-limit error across several of Uranium's liquidity pools and took about $53.3 million, and Uranium shut down. Prosecutors say he then moved the funds through complex crypto transactions, including the Tornado Cash mixer.

He faces a maximum of 10 years in prison on the computer fraud count and 20 years on the money laundering count. US District Judge Jed S. Rakoff will set the sentence; Gizmodo reports that will happen next year (Gizmodo).

What investigators seized

Agents searched his home under a warrant and seized items including the Black Lotus, the Wright brothers fabric and antique coins, according to the release. Separately, in February 2025, authorities seized cryptocurrency then worth about $31 million.

The Black Lotus is the only card the release names among the seized items. It doesn't say where the Alpha packs, the Base Set or the Pokémon box are now, and it doesn't say what will happen to anything that was seized. It asks possible victims of the Uranium hacks to contact Homeland Security Investigations. Dexerto's coverage of the verdict adds no detail on the cards' whereabouts (Dexerto).

Why these prices aren't comps

The $3 million figure tells us what a buyer paid for these items at some point after April 2021, the month of the hacks. The release gives no purchase dates, no sellers, no venues and no grades. It doesn't say which printing the Black Lotus is; the card appears in Magic's Alpha, Beta and Unlimited sets, which trade at very different prices. So none of these figures can be checked against a dated public sale, and we won't treat them as comps for any of the items.

The list does show where a buyer with millions to place chose to put it. In the prosecutors' account, four of the six collectibles he bought were cards, and they took about 80% of the spending, next to an ancient coin and a piece of aviation history. At the top of the market, vintage Magic and 1st Edition Pokémon now sit in the same category as rare coins: small objects that can each hold a six-figure sum.

Crypto shows up in another card case this year. Dexerto points to a separate July 2026 case in which a Philadelphia man allegedly used fake cryptocurrency to buy a Poncho-Wearing Pikachu card worth $24,200 at a police exchange zone in New Jersey.

What to watch

• Sentencing: Judge Rakoff sets the date and the sentence; Gizmodo reports it will come next year.
• Forfeiture: any court order covering the seized Black Lotus and the other items. A forfeited card can return to the market; the release says nothing about that yet.
• The unseized cards: whether filings or reporting say where the 18 Alpha packs, the 1st Edition Base Set and the sealed Pokémon box are.

Figures are approximate purchase prices as reported by prosecutors on October 7, 2026, not sale results. Percentages and averages are our arithmetic from those figures. This is market data and commentary, not investment advice.

Sources

• US Attorney's Office, Southern District of New York, Jonathan Spalletta convicted of defrauding crypto exchange in over $50 million hacks, Oct 7, 2026
• Gizmodo (Bruce Gil), Man who spent millions on rare Pokémon and Magic cards found guilty of stealing over $50 million in crypto, Oct 7, 2026
• Dexerto (Dylan Horetski), Crypto hacker convicted of $53M theft after spending millions on rare Pokémon and Magic cards, Oct 8, 2026