Crypto Fraud Watch: A Manhattan Jury Convicts the Uranium Finance Hacker, $12.5 Million Leaves 79thVault, and Bitcoin ETFs Shed $485 Million

Four stories from the past two days, each about accountability when money moves on-chain and nobody can claw it back: a conviction on all counts for a 2021 exploit, $12.5 million drained from a BNB Chain vault by one key, the worst day for Bitcoin ETF withdrawals since June, and a token standard with freeze-and-seize built in.

A Manhattan Jury Rejects the "It Was in the Code" Defense

On October 7, after a six-day trial before U.S. District Judge Jed S. Rakoff, a jury convicted Jonathan Spalletta, 36, of Rockville, Maryland, on every count: computer fraud and money laundering. Prosecutors in the Southern District of New York proved two April 2021 attacks on Uranium Finance. The first drained roughly $1.4 million, about $386,000 of which Spalletta kept under a purported bug bounty. The second, on April 28, took about $53.3 million and left the platform insolvent. Proceeds moved through Tornado Cash and into collectibles; agents seized roughly $31 million in cryptocurrency in February 2025.

The significance is in what the jury refused to accept. Exploiting a flaw a developer left in a smart contract is not a permitted interaction with an open system; it is unauthorized access to a protected computer. Spalletta faces up to 10 years on the fraud count, 20 on laundering.

$12.5 Million Leaves 79thVault, and the Key That Did It

Between 07:25 and 08:19 UTC on October 7, an operator wallet moved about 2.01 million 79AU tokens out of the 79AU/USDT PancakeSwap pool on BNB Chain and sold them back into it for real USDT. Pool reserves fell from about $15.2 million to $3.9 million. Monitors flagged a suspected private key compromise or insider action rather than a code bug.

Diligence details matter. The privileged OPERATOR_ROLE sat with one address, no apparent multisig or timelock, over a contract never verified on BscScan. A later on-chain message from that same key offered a 10 percent bounty, which tells you nothing about who controls it.

Bitcoin ETFs Post Their Worst Day Since June

U.S. spot Bitcoin ETFs saw $484.9 million in net withdrawals on October 7, the largest single-day outflow since June 25, with BlackRock's IBIT accounting for $207.7 million. Ether funds lost another $160.9 million, extending a seven-session streak to roughly $568.8 million. Bitcoin traded near $82,674 on Thursday.

Flows are market data, not misconduct. But redemption pressure tests valuation policies, liquidity disclosures, and custody arrangements, and it is when retail "recovery" and "guaranteed yield" pitches reappear.

Cardano Puts Freeze-and-Seize Inside the Token

Also on October 7, the Cardano Foundation announced at TOKEN2049 that CIP-0113, its programmable token standard, is live on mainnet. Issuers can write KYC checks, allowlists, transfer restrictions, and freeze-and-seize powers into an asset's own logic rather than a wrapper contract. The Swiss standards body CMTA will treat it as equivalent to its own CMTAT.

For holders, that changes the nature of the asset: a token the issuer can freeze carries counterparty risk a bearer instrument does not. When an issuer may freeze a wallet, and with what notice or appeal, is governed by the token's terms and the chosen jurisdiction, not the blockchain.

How to Protect Yourself

Before putting funds in a yield vault, check who holds the privileged roles. A single operator key with no multisig or timelock, over an unverified contract, is the configuration that emptied 79thVault in under an hour. Verify the contract source, look for a published audit, and read an unexplained "system upgrade" notice during an outflow as a warning, not a reassurance.

If you have already lost funds, timing matters more than most victims realize. Exchange freeze requests and civil asset tracing work best in the first hours, before funds are consolidated or bridged. Report promptly, preserve transaction hashes, wallet addresses, and communications, and involve counsel early. The Spalletta case shows these prosecutions succeed, but such outcomes take years and depend on evidence gathered at the start.

At Coin Counsel, we work with individuals and businesses navigating the legal fallout of crypto fraud — whether you're a victim seeking recovery, a company facing regulatory scrutiny, or a project working to stay compliant in an increasingly complex legal landscape. The rules are evolving fast, and the cost of getting it wrong has never been higher. Contact us at coin-counsel.com to speak with a crypto-focused attorney today.

Disclaimer

This blog post is for informational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship between you and Coin Counsel or Franco Law PLLC. The legal landscape surrounding cryptocurrency is rapidly evolving and varies by jurisdiction. Do not act or refrain from acting based on information in this post without first consulting a qualified attorney. If you believe you have been the victim of crypto fraud, contact us at coin-counsel.com for a consultation.