DB-cleanup/merge-output/sources/424_Unnamed-Brentwood-resident.txt

================================================================================================
CASE 424  |  Unnamed Brentwood resident  |  December 31, 2025  |  USA
================================================================================================

DATABASE RECORD
  id                  424
  date                December 31, 2025
  original_date       December 31, 2025
  year                2025
  month               12
  quarter             2025-Q4
  victim              Unnamed Brentwood resident
  location            Brentwood, California
  country             USA
  scenario            Dodged Attack
  description         Victim received delivery, suspect asked for water, followed victim into kitchen at gunpoint and bound him with zip ties and duct tape. Second suspect arrived, third person on speakerphone with voice modulator ordered them to cut off victim's fingers to reveal "real" crypto amount. 
  kidnappings         1
  violence_torture    1
  drugs_alcohol       (null)
  weapons             1
  theft               0
  life_taken          0
  money_wanted        (null)
  coin_type           Crypto
  reports             SF Chronicle
  notes               Witness hiding in pantry called 911; helicopter overhead spooked suspects who fled; Elijah Armstrong and Jayden Rucker arrested after car chase.


  has_processed_date  0
  created_at          2026-04-07 14:56:08

AI SUMMARY  [generated at bulk import, NOT verified against sources]
  **Victims:** Man living in Brentwood (tony LA neighborhood), witness hiding in pantry during attack

  

  **Attackers:** Elijah Armstrong (Tennessee, arrested), Jayden Rucker (Tennessee, arrested), third person on phone with voice modulator (not arrested)

  

  **Attack Method:** Fake delivery driver asked for glass of water. Victim agreed, walked to kitchen. Suspect followed, pulled gun, bound victim with zip ties and duct tape. Second suspect (Armstrong or Rucker) arrived. Both called third person on speakerphone whose voice was distorted by modulator.

  

  **Violence Used:** Victim bound with zip ties and duct tape. Forced to give computer password. Voice on phone became angry when seeing victim's crypto holdings and ordered attackers to cut off victim's fingers until he showed "real amount." One suspect picked up knife but both fled when helicopter heard overhead.

  

  **Crypto Demanded/Stolen:** Zero. Victim gave computer password allowing view of crypto holdings but transfer not completed before suspects fled.

  

  **Status:** Witness hiding in pantry escaped house and called 911. Brief car chase. Armstrong and Rucker arrested. Both charged with robbery, burglary, assault with a firearm, attempted extortion (threat to cut off fingers). Armstrong faces additional charge of fleeing pursuing officer.

LINKED SOURCES
  [url]  https://www.sfchronicle.com/crime/article/crypto-wrench-attack-home-invasion-22088091.php
  [url_2]  https://ktla.com/news/california/violent-crypto-robberies-los-angeles-bay-area/

OTHER LINKED SOURCES
  [BLOCKED]  url_2  None — raw request refused; try the WebFetch path, which is a model transcription and must be labelled as such
      https://ktla.com/news/california/violent-crypto-robberies-los-angeles-bay-area/

------------------------------------------------------------------------------------------------
FETCHED ARTICLE 1  [RAW EXTRACT — NOT YET TRIMMED]
  !! This is the whole page as extracted. It still contains site furniture,
  !! and may contain teaser headlines for UNRELATED cases. Trim on read-through.
  !! Do not quote from it without checking the passage belongs to this case.
  Source     sfchronicle.com
  URL        https://www.sfchronicle.com/crime/article/crypto-wrench-attack-home-invasion-22088091.php
  Field      url
  Retrieved  2026-08-06T13:40:48+00:00 via raw HTTP retrieval, deterministic extraction (HTTP 200)
  Language   unknown
  Kept       paragraphs ALL 81 paragraphs, untrimmed
  Length     16,038 chars
  Integrity  sha256 a023674e67e652a8b36377cb73530ad7e14310ad1e7c75ffb0fd4d4423ea6e4a
  Trimmed    NOT TRIMMED. Full page extract; trim on read-through.
  Caveat     retrieved from a live page on the date above. Unlike text copied
             from the spreadsheet, there is no second copy to hash it against.
------------------------------------------------------------------------------------------------

ORIGINAL (unknown, verbatim as retrieved)

Crime ring stole millions in crypto in California ‘wrench attacks’

Fake deliveries, then guns: How a ‘wrench attack’ crime ring chased crypto millions from S.F. to L.A.

Daymond Gascon/S.F. Chronicle; Getty Images

By Megan Cassidy, Staff WriterApril 3, 2026

San Francisco, San Jose, Sunnyvale, Los Angeles.

In each city, the plan was the same: Stake out a major cryptocurrency holder, pose as a food or package courier, and pull out the gun.

Documents obtained by the Chronicle reveal evidence that police say links three attempted armed crypto robberies in the Bay Area and Los Angeles in December to a harrowing home invasion a month earlier, in which a San Francisco man was drained of $13 million worth of digital currency after members of the crime ring ordered pizzas to his home before binding him with duct tape, pistol-whipping him and threatening to cut off his fingers.

As of this week, three men from Tennessee were in custody and charged in connection with the targeting of large crypto account holders in two of the crimes, in Sunnyvale and Los Angeles. Sources said authorities were still looking for higher-level operatives in the four cases, which resemble an emerging strain of crypto theft known as “wrench attacks.”

Unlike other crimes that use hacking or social engineering scams to access victims’ funds remotely, wrench attacks rely on more brutish methods of coercion like kidnapping and torture. The crime’s nickname stems from a stick-figure web comic depicting one cybercriminal instructing another to hit a victim “with this $5 wrench until he tells us the password.”

A recent report from cybersecurity firm Certik showed 72 documented instances of wrench attacks across the globe in 2025 — a 75% spike from the year prior — though the company said the crimes are certainly underreported.

Cases that are known to the public have laid bare some of the extreme measures criminals have taken to extract the victims’ funds. In January 2025, a gang in France abducted a crypto firm’s co-founder and his wife, cut off one of the man’s fingers, and held the pair ransom under demands for funds from the company. In May, an Italian man was held captive for weeks in a Manhattan town house while abductors beat him, shocked him with electric wires and held him over a ledge in order to get his Bitcoin password.

The attacks bring into sharp relief how some of the key selling points of crypto — decentralization from banks, the ease of transferring large sums, irreversible transactions — also double as its vulnerabilities.

Banks are tightly regulated by laws meant to protect consumers from theft and fraud. They can freeze accounts or reverse funds, set limits on the amounts that can be transferred in one day, and flag suspicious activities.

Crypto, meanwhile, is attractive because of the autonomy it affords account holders, said Ari Redbord, head of global policy at TRM Labs, a firm that monitors and investigates digital-asset fraud.

“The promise of the technology itself is this idea of cross-border value transfer at the speed of the internet,” Redbord said.

“However,” he added, “bad guys also want to move funds, and transactions are irreversible, which makes it very ripe for this type of activity.”

While specifics on how the thieves identified or found their targets in California remains unclear, police and court records, as well as interviews with individuals close to the investigations, shed light on some of the patterns.

A Sunnyvale financial crimes detective who investigated one of the recent cases, and asked to withhold his name, described the robberies as a “long play” that begins with surveillance. In at least some of the recent cases, this involved infiltrating the victim’ delivery apps like DoorDash or Uber Eats with malware, allowing thieves to learn the victim’s address and other key information.

“They figure out your trends, your life cycle,” said the detective. “What do you normally order online? What do you normally order for takeout? Where do your packages normally come from? And then the suspects are disguising themselves as Door Dash drivers or UPS delivery drivers — finding a way to get you to your front door and open the front door.”

A victim who spoke to the Chronicle but asked that their name be withheld said the suspects visited their home multiple times. Three days before the incident, someone had dropped off cookies from a bakery he had recently ordered from.

After speaking with detectives, the victim learned one of his recycled passwords was likely compromised in a data breach, laying the groundwork for a targeted attack.

While he said it’s not clear exactly how the suspects found him, the victim said a common scenario begins with hackers distributing batches of information to a second layer of bad actors, often through apps like Telegram or Signal.

From there, the victim said the attacker will try something known as “password spraying” — testing out email and password combinations on multiple apps.

“They’ll just spam that password on as many accounts as they can get into,” the victim said. “For me, it was my DoorDash and Uber Eats accounts. I hadn’t changed those passwords in so long.”

In his own case, the victim said he learned from detectives that the suspects at his house were in contact with a third party who passed along intel on some of the victims’ online orders.

“They would get screenshots from the person behind it, like, ‘Hey, this guy’s DoorDashing up at this place. Go pick up a fake order.”

Records show at least two victims in the recent California attacks were expecting a delivery when the suspect arrived carrying the same item or a similar one. In the San Francisco and Los Angeles cases, the suspects called their victims on multiple occasions — from the same phone number — to confirm a time to accept their purported delivery. In at least three of the cases, the victims received food deliveries that they didn’t order prior to the attack.

Mentions of DoorDash were another common thread. Records showed one of the phone numbers linked to a suspect called DoorDash’s customer service line three times between the time the phone account was created on Nov. 21, and the San Francisco robbery the following day. In the Sunnyvale case, one of the coffees that the victim didn’t order had a DoorDash receipt on its bag.

A spokesperson for DoorDash said it could not respond to specific questions due to the ongoing nature of the investigations. The spokesperson said the company was working with the FBI and other law enforcement agencies “to support their investigations and help ensure those responsible are brought to justice.”

Local police agencies told the Chronicle that the FBI is involved in investigating the cases. A spokesperson for the FBI declined to comment other than to confirm the agency is investigating the San Francisco case.

The San Francisco victim told police he had been expecting a package when a young man arrived at his doorstep in the Mission Dolores neighborhood around 5 p.m. on Nov. 22, carrying a white box.

The victim had received multiple calls from the same phone number in the hours before the visit, from a caller who claimed to be a UPS employee attempting to deliver a package.

What came next, according to police reports, was an hourlong ordeal in which the robber, after pushing his way into the home, bound the victim with duct tape, pistol-whipped him and repeatedly threatened to kill him while demanding access to his phone and laptop.

All the while, the robber spoke on the phone, taking instructions from several people, including a man with a “raspy voice,” according to records. The victim recalled hearing what sounded like a voice modulator used by a person on the phone, as well as threats to cut off his fingers if he didn’t comply with the group’s demands. The thieves ultimately made off with $10 million in Bitcoin and $3 million in Ethereum — holdings the victim later told police were publicly known.

It wasn’t until after the robbery that the victim noticed two boxes of pizza that he didn’t order, sitting outside his home.

At the onset of the investigation, San Francisco police obtained search warrants for two key phone numbers: one for a number that ordered the pizzas, and another for one that called the victim about the purported UPS delivery.

The numbers were burners, created only a day before the robbery, but logs of text messages and phone calls cracked open other leads and helped signal to police that the cases were related, according to documents reviewed by the Chronicle.

Six phone calls made from one of the suspect numbers — in between calls to the San Francisco victim on the day of his robbery — were to a Los Angeles man who was zip-tied, duct-taped and beaten inside his Los Angeles home on New Year’s Eve, following a delivery ruse. The two home invaders, as well as another suspect on the phone, demanded the man’s crypto.

“It appears a suspect in the San Francisco crypto robbery was seeking intel on the Los Angeles victim on the same day,” San Francisco police Sgt. Ryan Hart told a judge in January as part of a request for additional search warrants.

On Dec. 17, a San Jose man who was stepping out of his vehicle after returning to his home noticed someone standing next to his driveway.

The person, the resident later said, produced a black handgun and ordered him to enter the garage and close the door. The suspect then hit the man on the back of the head. The victim fell to the ground, he told police, pretending to be injured.

The attack was interrupted by an Amazon truck that drove by, the victim said, prompting the suspect and another person to flee on foot. The victim later told officers he believed he was targeted because information on his crypto holdings had recently been leaked, according to a police report.

He additionally relayed strange, earlier incidents he suspected could be connected. On Dec. 6, he received two pizza deliveries he didn’t order, the man said. About a week later, on Dec. 15, he was approached by people who claimed to work for a power-washing company and offered to clean his driveway for free. The victim “believed this was odd and he rejected their attempts several times,” police said.

Five days after the San Jose attack, on the morning of Dec. 22, Sunnyvale police were called to a home to investigate a report that a man who said he was delivering a DoorDash order for coffee had pushed his way inside and aimed a gun at the victim who answered the door.

After the victim pushed back, the man ran away and fled in a black Kia sedan. The suspect, identified as 21-year-old Nino Chindavanh of Tennessee, was pulled over and arrested and is facing charges of attempted robbery and burglary in Santa Clara County.

In the car, police seized a wallet containing identification, medical documentation and debit cards issued to a man named Jayden Rucker, police said.

A police review of the residents’ doorbell camera footage showed Chindavanh and another unidentified man attempting to deliver Starbucks coffees both before and after the real order.

Four times in a matter of two hours, police said, either Chindavanh or the other man approached the residence. In the final visit, police said, Chindavanh said, “It says I can’t cancel the order,” before pulling out the gun.

Eight days later, a resident in the Sunnyvale home contacted police again, reporting that another coffee no one had ordered had arrived at the house. The victim told police they had a large sum of cryptocurrency.

After viewing security footage, police said they believed this person was Jayden Rucker, the man whose wallet was left in the Kia. Police believed Rucker was also the second suspect who was in the bushes at the time of the incident a week earlier.

The following day, at a home in Los Angeles’ tony Brentwood neighborhood, a man delivering a package to the resident asked for a glass of water. The victim agreed and walked into the kitchen, police said.

The suspect followed him inside, pointed a gun at him and bound him with zip ties and duct tape. A second suspect arrived, and the pair called a third person on speakerphone whose voice appeared to be distorted by a modulator.

The victim said he gave the intruders the password to his computer, allowing them to view his crypto holdings. The voice on the phone became angry, the victim said, and ordered the home invaders to cut off the victim’s fingers until he showed them the “real amount he had in crypto currency.”

One of the suspects picked up a knife. But after hearing a helicopter circling above, the two men fled. A witness who had been hiding in the pantry during the attack said she was able to slip out of the house and call 911, according to police records.

After a brief car chase, police arrested two suspects, identified as Elijah Armstrong and Jayden Rucker.

Armstrong and Rucker were both charged with robbery, burglary, assault with a firearm and attempted extortion for threatening to cut off the victim’s fingers. Armstrong faces an additional charge of fleeing a pursuing peace officer’s motor vehicle.

It isn’t clear whether any suspects other than the three charged in Los Angeles and Santa Clara counties have been arrested or identified.

The Sunnyvale detective said similar enterprises have involved multiple levels of operatives, with everyone getting paid different amounts.

“The larger masterminds behind it don’t want to be the ones physically at a door, that are subject to more risk,” he said. “They’re going to find somebody local, or different crews working throughout the state for a percentage of the profits.”

The detective said police believe all of the suspects who committed the in-person robberies and assaults in the Bay Area and California have been arrested.

Redbord, of TRM Labs, said that despite crypto’s inherent vulnerabilities, law enforcement and security firms are able to trace the flow of funds through blockchains — the technology underpinning crypto transactions that acts as a ledger. The analysis makes it easier to identify the criminals behind cyberattacks, and has enabled law enforcement to at times seize back the stolen money. It was not clear whether law enforcement has been able to locate or seize back the funds from the San Francisco case.

Wrench attacks, Redbord said, are in some ways a natural evolution of crimes like robbery and narcotics trafficking.

“This is not a ‘crypto ring’, per se,” he said. “It’s a, ‘Bad guys always go where the money is.’”

Megan Cassidy is an enterprise reporter focusing on public safety and criminal justice. A longtime crime reporter, Megan has covered issues including the drug market, police accountability and public corruption. Megan is a two-time Mizzou graduate and loves records dives and confidential sources.

To provide story tips or to obtain her Signal number, email megan.cassidy@sfchronicle.com.

Oakland renters had the upper hand. Now, the market is turning against them

As San Francisco’s artificial intelligence boom drives up housing demand and rents, some of that pressure is moving east across the bay.

Wealthy Bay Area region eyes $365 million event center, but not everyone is on board

Oakland approved a $105 million teachers deal. One board member’s dual role could threaten it

UC Berkeley close to landing Memorial Stadium’s first major concert in 36 years. Neighbors are worried

Yemeni cafés are everywhere in the Bay Area. This restaurant shows its food deserves a spotlight, too

1.

Broadcaster Greg Papa laid off by KNBR as part of shuffle in midday programming

2.

A mysterious landlord. A tenant revolt. Inside a bizarre, only-in-San Francisco housing battle

3.

Powerful El Niño puts California in the bull’s-eye for soaking winter, models show

4.

Do S.F. two-bedrooms really rent for $6,000 now? What the viral claim leaves out

5.

Millions of older adults in California may face higher Medicare prescription drug premiums in 2027

================================================================================================
generated from attacks-export-Gart-website.json + reported_K&R  |  case 424
================================================================================================