Uranium Finance hack — April 2021

Uranium Finance was an automated market maker on BNB Chain, forked from PancakeSwap. On 28 April 2021, roughly two hours before it was due to migrate users to a patched v2.1, an attacker emptied its v2 pairs. The fault was in the constant used by the pair contract's balance sanity check. As researcher Igor Igamberdiev described it, balances during the check were treated as a hundred times larger than they actually were, so a swap could be settled against reserves that did not exist and a minimal deposit was enough to withdraw a pool. The flaw had been live since the v2 upgrade over a week earlier, and CoinDesk reported it was known to seven Uranium team members and three auditors before the exploit.

CoinDesk reported the drained assets as roughly $18 million in BNB, $18 million in BUSD, about $9 million in ETH and BTCB, $6.7 million in USDT and $1.7 million in DOT, ADA and the project's U92 token, putting the contemporaneous total near $50 million. The 2026 US indictment states $53.3 million was taken across 26 liquidity pools. Uranium Finance shut down, never reopened, and did not compensate users.

On 30 March 2026 prosecutors in the Southern District of New York unsealed an indictment charging Jonathan Spalletta, 36, of Maryland, with computer fraud and money laundering over this exploit and an earlier one on 8 April 2021 that took about $1.4 million from the protocol's rewards mechanism, after which prosecutors say he negotiated a sham bug bounty and kept roughly $386,000. The proceeds were allegedly laundered through Tornado Cash and spent on collectibles. Spalletta surrendered to authorities and faces a maximum of 30 years. Around $31 million was seized by US authorities in February 2025; that seizure is a law-enforcement forfeiture and no funds have been returned to users. The charges remain allegations.