Charges in Uranium Finance Case

Every week, ISMG rounds up cybersecurity incidents in digital assets. This week, charges in Uranium Finance hack, indictment of Chinese firms in fentanyl supply case, class action against Nvidia, Drift Protocol exploit, KuCoin operational barriers in the US and UK sanctioning Xinbi.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

U.S. prosecutors have charged Jonathan Spalletta, a Maryland resident, with carrying out two hacks of decentralized exchange Uranium Finance in 2021, stealing millions and forcing the platform to shut down. He faces one count of computer fraud and one count of money laundering, with a combined maximum sentence of 30 years.

Authorities say Spalletta first exploited smart contract logic in April 2021, using deceptive transactions to withdraw excess rewards and drain about $1.4 million from a liquidity pool. Weeks later, authorities says he exploited another vulnerability, stealing $53.3 million and crippling the exchange.

Prosecutors say he laundered the proceeds and spent millions on rare collectibles, including trading cards and historic memorabilia linked to the Apollo 11 moon landing. U.S. authorities later seized about $31 million in cryptocurrency tied to the initial hack.

A federal grand jury in Ohio indicted two Chinese pharmaceutical companies and six individuals for allegedly supplying fentanyl precursors and laundering money through cryptocurrency. Prosecutors say the firms sold chemicals, including medetomidine, to drug traffickers and instructed buyers to pay through crypto wallets under their control. Authorities brought the case under the FBI’s Operation Box Cutter, which targets global fentanyl networks, and charged three defendants with attempting to support a Mexican cartel designated as a terrorist organization.

Investigators say the accused used cryptocurrency to process payments, moving funds through multiple wallets before converting them to fiat overseas. If convicted, the defendants could face life sentences for drug trafficking and up to 20 years for money laundering and terrorism-related offenses.

A U.S. federal judge has allowed investors to proceed as a class in a lawsuit accusing Nvidia and CEO Jensen Huang of misleading disclosures about crypto-related revenue. The court found that plaintiffs met the standard for class certification and rejected Nvidia’s attempt to block the case and exclude expert analysis on damages.

Investors allege Nvidia understated how much its gaming GPU revenue depended on cryptocurrency mining between 2017 and 2018, claiming most of that revenue came from GeForce GPUs rather than its OEM segment. The judge ruled Nvidia failed to fully counter evidence that these statements affected its stock price, especially after a November 2018 disclosure that triggered a 28.5% drop.

Analysts later estimated crypto-related revenue far exceeded Nvidia’s reported figures. While the ruling does not establish liability, it allows investors to pursue claims collectively as the case moves forward.

Solana-based Drift Protocol has suffered an exploit, with losses estimated between $200 million and $270 million. The attackers targeted multiple vaults, including JLP Delta Neutral, SOL Super Staking and BTC Super Staking. A single transfer of 41.7 million JLP tokens accounted for roughly $155 million, while other assets such as SOL, USDC, cbBTC, and wBTC were also drained.

Drift acknowledged unusual activity and urged users to avoid deposits while it investigates. Analysis shows the incident could rank among the largest crypto hacks and one of the biggest on Solana after the Wormhole exploit.

The attacker has begun swapping stolen assets into USDC via Jupiter and bridging funds to Ethereum to purchase ETH, holding nearly 20,000 ETH worth about $42 million.

A U.S. court has ordered Peken Global Limited, which operates KuCoin, to permanently block U.S. users unless it registers as a foreign board of trade. The ruling, issued by the Southern District of New York, also imposes a $500,000 civil penalty related to an enforcement action by the Commodity Futures Trading Commission.

Regulators accused Peken Global and affiliated entities of running an unlicensed digital asset derivatives exchange, failing to register properly and lacking effective customer identification controls. The consent order bars future violations but does not require disgorgement, citing the firm’s cooperation in related investigations.

The decision follows earlier legal action, including a 2025 guilty plea by Peken Global for operating an unlicensed money transmitting business, which resulted in over $290 million in fines and forfeiture. As part of that agreement, KuCoin must exit the U.S. market for at least two years.

The U.K. government has imposed sanctions on a crypto-enabled marketplace and several individuals linked to large-scale scam operations across Southeast Asia. Authorities targeted Xinbi, a Chinese-language illicit platform that facilitates fraud by enabling the sale of stolen data and providing crypto-based services to scam networks. Data from Chainalysis shows Xinbi processed over $19.9 billion in transactions between 2021 and 2025.

Officials said scam centers across the region use schemes such as fake romantic relationships to defraud victims, while many workers are trafficked and forced to participate under coercion. The sanctions also target Legend Innovation Co., linked to a major scam compound in Cambodia, and associated individuals.