U.S. Authorities Seize $31 Million Related to Uranium Finance Hack

This week, the U.S. Attorney's Office for the Southern District of New York (SDNY) and Homeland Security Investigations (HSI) San Diego successfully seized approximately USD 31 million in stolen assets, marking a significant breakthrough in the Uranium Finance exploits case. Nearly four years after hackers drained USD 53.7 million from the Binance Smart Chain-based decentralized finance (DeFi) protocol, law enforcement, with the support of TRM Labs, was able to track, recover, and disrupt the illicit financial flows linked to the attack. The case highlights the increasing effectiveness of blockchain intelligence in long-term investigations and asset recovery.

The Uranium Finance Exploits: A Tale of Two Attacks

In April 2021, Uranium Finance suffered two devastating hacks in quick succession due to vulnerabilities in its smart contract code. The first attack, which took place between April 6-8, exploited flaws in the protocol’s reward distribution system, allowing hackers to steal approximately USD 1.4 million. Following negotiations with the project team, the attackers unexpectedly returned $1 million in assets but retained USD 385,500, which was later laundered through Tornado Cash.

Just weeks later, on April 28, a second exploit targeted a single-character code error in Uranium Finance’s trading logic, leading to the theft of USD 52 million. The flaw acted as a faulty vault mechanism, miscalculating balances and allowing attackers to withdraw significantly more tokens than should have been permitted. The sheer simplicity of the exploit exposed critical weaknesses in smart contract security. After the attacks, the stolen assets were funneled through Tornado Cash and various decentralized exchanges, converted into different cryptocurrencies, and partially hidden in dormant wallets. Some of these funds remained untouched for nearly four years before being moved again in early 2024.

Tracing Hacked Funds

In February 2023, TRM worked closely with law enforcement to meticulously trace the movement of stolen assets across multiple blockchains, identifying key laundering patterns and generating actionable intelligence for law enforcement. By March 2023, the team had mapped out the attackers' attempts to obfuscate their funds, linking them to Tornado Cash transactions and cross-chain swaps. As a result, law enforcement was able to successfully seize USD 31 million in outstanding funds in February 2025.

A Landmark Case in DeFi Exploit Recovery

The successful seizure of assets in the Uranium Finance investigation demonstrates how law enforcement is increasingly capable of tracking and recovering stolen crypto, even years after an attack. This case serves as a warning to cybercriminals that blockchain intelligence tools and investigative expertise are evolving, making it harder for stolen funds to remain hidden indefinitely.

The Uranium Finance exploits also underscore critical lessons for the DeFi industry. Even minor coding errors can result in catastrophic financial losses, emphasizing the need for rigorous security audits and ongoing protocol updates. Laundering networks are becoming more sophisticated, with stolen assets sometimes lying dormant for years before re-entering the financial system. However, the ability of law enforcement and blockchain intelligence firms like TRM to track, identify, and ultimately seize stolen assets proves that illicit actors are not beyond reach.