DB-cleanup/merge-output/sources/422_Unnamed-San-Jose-crypto-holder.txt

================================================================================================
CASE 422  |  Unnamed San Jose crypto holder   |  December 17, 2025  |  USA
================================================================================================

DATABASE RECORD
  id                  422
  date                December 17, 2025
  original_date       December 17, 2025
  year                2025
  month               12
  quarter             2025-Q4
  victim              Unnamed San Jose crypto holder 
  location            San Jose, California
  country             USA
  scenario            Dodged Attack
  description         He was returning home in his vehicle and noticed an armed suspect standing by driveway who produced black handgun, ordered him into garage, and hit him on back of head.
  kidnappings         1
  violence_torture    1
  drugs_alcohol       (null)
  weapons             1
  theft               0
  life_taken          0
  money_wanted        (null)
  coin_type           Crypto
  reports             SF Chronicles
  notes               Victim fell and pretended to be seriously injured. Suspect and accomplice fled when Amazon delivery truck drove by; zero stolen.

  has_processed_date  0
  created_at          2026-04-07 14:45:02
  (flag legend: 'kidnappings' is the DETENTION flag — 1 when the victim was held against
   their will at any point, tied, locked in, held at gunpoint or taken away; it is NOT the
   same as the 'Kidnapping' scenario, which means taken away and held. See README, Definitions.)

AI SUMMARY  [generated at bulk import, NOT verified against sources]
  **Victim:** San Jose man, crypto holder whose holdings information had recently been leaked
  
  **Attackers:** 2 men (unidentified, fled before arrest)
  
  **Attack Method:** Armed ambush in victim's driveway as he returned home. Victim had received 2 unsolicited pizza deliveries 11 days earlier (Dec 6). Two days before attack (Dec 15), strangers approached offering free power-washing service for driveway, which victim declined multiple times finding it "odd."
  
  **Violence Used:** Suspect hit victim on back of head with gun. Victim fell to ground and pretended to be seriously injured.
  
  **Crypto Demanded/Stolen:** Zero. Attack interrupted before extortion demands made.
  
  **Status:** Attack foiled by passing Amazon delivery truck. Both suspects fled on foot. No arrests reported for this specific incident. Believed connected to Tennessee crime ring (Chindavanh/Rucker/Armstrong).

LINKED SOURCES
  [url]  https://www.sfchronicle.com/crime/article/crypto-wrench-attack-home-invasion-22088091.php
  [url_2]  https://ktla.com/news/california/violent-crypto-robberies-los-angeles-bay-area/

------------------------------------------------------------------------------------------------
FETCHED ARTICLE 1  [AUTO-TRIMMED — UNREVIEWED]
  !! Furniture was cut by a script keyed on this case's record, not by a person.
  !! It may still carry passages about OTHER cases from a round-up article.
  !! The full page extract is kept in staging/ if a cut needs revisiting.
  Source     sfchronicle.com
  URL        https://www.sfchronicle.com/crime/article/crypto-wrench-attack-home-invasion-22088091.php
  Field      url
  Retrieved  2026-08-06T13:40:56+00:00 via raw HTTP retrieval, deterministic extraction (HTTP 200)
  Language   unknown
  Kept       paragraphs headline [0] + 20-66 of 81
  Length     10,794 chars
  Integrity  sha256 cafddee5b8a70554250bcfa34f1dd0ba28cefc6fd89681170bec1387fa54f74d
  Trimmed    AUTO-TRIMMED, unreviewed: kept paragraphs 20-66 plus headline [0]; dropped 19 leading and 14 trailing paragraphs. Case-term hits on page: 33.
  Caveat     retrieved from a live page on the date above. Unlike text copied
             from the spreadsheet, there is no second copy to hash it against.
------------------------------------------------------------------------------------------------

ORIGINAL (unknown, verbatim as retrieved)

Crime ring stole millions in crypto in California ‘wrench attacks’

After speaking with detectives, the victim learned one of his recycled passwords was likely compromised in a data breach, laying the groundwork for a targeted attack.

While he said it’s not clear exactly how the suspects found him, the victim said a common scenario begins with hackers distributing batches of information to a second layer of bad actors, often through apps like Telegram or Signal.

From there, the victim said the attacker will try something known as “password spraying” — testing out email and password combinations on multiple apps.

“They’ll just spam that password on as many accounts as they can get into,” the victim said. “For me, it was my DoorDash and Uber Eats accounts. I hadn’t changed those passwords in so long.”

In his own case, the victim said he learned from detectives that the suspects at his house were in contact with a third party who passed along intel on some of the victims’ online orders.

“They would get screenshots from the person behind it, like, ‘Hey, this guy’s DoorDashing up at this place. Go pick up a fake order.”

Records show at least two victims in the recent California attacks were expecting a delivery when the suspect arrived carrying the same item or a similar one. In the San Francisco and Los Angeles cases, the suspects called their victims on multiple occasions — from the same phone number — to confirm a time to accept their purported delivery. In at least three of the cases, the victims received food deliveries that they didn’t order prior to the attack.

Mentions of DoorDash were another common thread. Records showed one of the phone numbers linked to a suspect called DoorDash’s customer service line three times between the time the phone account was created on Nov. 21, and the San Francisco robbery the following day. In the Sunnyvale case, one of the coffees that the victim didn’t order had a DoorDash receipt on its bag.

A spokesperson for DoorDash said it could not respond to specific questions due to the ongoing nature of the investigations. The spokesperson said the company was working with the FBI and other law enforcement agencies “to support their investigations and help ensure those responsible are brought to justice.”

Local police agencies told the Chronicle that the FBI is involved in investigating the cases. A spokesperson for the FBI declined to comment other than to confirm the agency is investigating the San Francisco case.

The San Francisco victim told police he had been expecting a package when a young man arrived at his doorstep in the Mission Dolores neighborhood around 5 p.m. on Nov. 22, carrying a white box.

The victim had received multiple calls from the same phone number in the hours before the visit, from a caller who claimed to be a UPS employee attempting to deliver a package.

What came next, according to police reports, was an hourlong ordeal in which the robber, after pushing his way into the home, bound the victim with duct tape, pistol-whipped him and repeatedly threatened to kill him while demanding access to his phone and laptop.

All the while, the robber spoke on the phone, taking instructions from several people, including a man with a “raspy voice,” according to records. The victim recalled hearing what sounded like a voice modulator used by a person on the phone, as well as threats to cut off his fingers if he didn’t comply with the group’s demands. The thieves ultimately made off with $10 million in Bitcoin and $3 million in Ethereum — holdings the victim later told police were publicly known.

It wasn’t until after the robbery that the victim noticed two boxes of pizza that he didn’t order, sitting outside his home.

At the onset of the investigation, San Francisco police obtained search warrants for two key phone numbers: one for a number that ordered the pizzas, and another for one that called the victim about the purported UPS delivery.

The numbers were burners, created only a day before the robbery, but logs of text messages and phone calls cracked open other leads and helped signal to police that the cases were related, according to documents reviewed by the Chronicle.

Six phone calls made from one of the suspect numbers — in between calls to the San Francisco victim on the day of his robbery — were to a Los Angeles man who was zip-tied, duct-taped and beaten inside his Los Angeles home on New Year’s Eve, following a delivery ruse. The two home invaders, as well as another suspect on the phone, demanded the man’s crypto.

“It appears a suspect in the San Francisco crypto robbery was seeking intel on the Los Angeles victim on the same day,” San Francisco police Sgt. Ryan Hart told a judge in January as part of a request for additional search warrants.

On Dec. 17, a San Jose man who was stepping out of his vehicle after returning to his home noticed someone standing next to his driveway.

The person, the resident later said, produced a black handgun and ordered him to enter the garage and close the door. The suspect then hit the man on the back of the head. The victim fell to the ground, he told police, pretending to be injured.

The attack was interrupted by an Amazon truck that drove by, the victim said, prompting the suspect and another person to flee on foot. The victim later told officers he believed he was targeted because information on his crypto holdings had recently been leaked, according to a police report.

He additionally relayed strange, earlier incidents he suspected could be connected. On Dec. 6, he received two pizza deliveries he didn’t order, the man said. About a week later, on Dec. 15, he was approached by people who claimed to work for a power-washing company and offered to clean his driveway for free. The victim “believed this was odd and he rejected their attempts several times,” police said.

Five days after the San Jose attack, on the morning of Dec. 22, Sunnyvale police were called to a home to investigate a report that a man who said he was delivering a DoorDash order for coffee had pushed his way inside and aimed a gun at the victim who answered the door.

After the victim pushed back, the man ran away and fled in a black Kia sedan. The suspect, identified as 21-year-old Nino Chindavanh of Tennessee, was pulled over and arrested and is facing charges of attempted robbery and burglary in Santa Clara County.

In the car, police seized a wallet containing identification, medical documentation and debit cards issued to a man named Jayden Rucker, police said.

A police review of the residents’ doorbell camera footage showed Chindavanh and another unidentified man attempting to deliver Starbucks coffees both before and after the real order.

Four times in a matter of two hours, police said, either Chindavanh or the other man approached the residence. In the final visit, police said, Chindavanh said, “It says I can’t cancel the order,” before pulling out the gun.

Eight days later, a resident in the Sunnyvale home contacted police again, reporting that another coffee no one had ordered had arrived at the house. The victim told police they had a large sum of cryptocurrency.

After viewing security footage, police said they believed this person was Jayden Rucker, the man whose wallet was left in the Kia. Police believed Rucker was also the second suspect who was in the bushes at the time of the incident a week earlier.

The following day, at a home in Los Angeles’ tony Brentwood neighborhood, a man delivering a package to the resident asked for a glass of water. The victim agreed and walked into the kitchen, police said.

The suspect followed him inside, pointed a gun at him and bound him with zip ties and duct tape. A second suspect arrived, and the pair called a third person on speakerphone whose voice appeared to be distorted by a modulator.

The victim said he gave the intruders the password to his computer, allowing them to view his crypto holdings. The voice on the phone became angry, the victim said, and ordered the home invaders to cut off the victim’s fingers until he showed them the “real amount he had in crypto currency.”

One of the suspects picked up a knife. But after hearing a helicopter circling above, the two men fled. A witness who had been hiding in the pantry during the attack said she was able to slip out of the house and call 911, according to police records.

After a brief car chase, police arrested two suspects, identified as Elijah Armstrong and Jayden Rucker.

Armstrong and Rucker were both charged with robbery, burglary, assault with a firearm and attempted extortion for threatening to cut off the victim’s fingers. Armstrong faces an additional charge of fleeing a pursuing peace officer’s motor vehicle.

It isn’t clear whether any suspects other than the three charged in Los Angeles and Santa Clara counties have been arrested or identified.

The Sunnyvale detective said similar enterprises have involved multiple levels of operatives, with everyone getting paid different amounts.

“The larger masterminds behind it don’t want to be the ones physically at a door, that are subject to more risk,” he said. “They’re going to find somebody local, or different crews working throughout the state for a percentage of the profits.”

The detective said police believe all of the suspects who committed the in-person robberies and assaults in the Bay Area and California have been arrested.

Redbord, of TRM Labs, said that despite crypto’s inherent vulnerabilities, law enforcement and security firms are able to trace the flow of funds through blockchains — the technology underpinning crypto transactions that acts as a ledger. The analysis makes it easier to identify the criminals behind cyberattacks, and has enabled law enforcement to at times seize back the stolen money. It was not clear whether law enforcement has been able to locate or seize back the funds from the San Francisco case.

Wrench attacks, Redbord said, are in some ways a natural evolution of crimes like robbery and narcotics trafficking.

“This is not a ‘crypto ring’, per se,” he said. “It’s a, ‘Bad guys always go where the money is.’”

Megan Cassidy is an enterprise reporter focusing on public safety and criminal justice. A longtime crime reporter, Megan has covered issues including the drug market, police accountability and public corruption. Megan is a two-time Mizzou graduate and loves records dives and confidential sources.

To provide story tips or to obtain her Signal number, email megan.cassidy@sfchronicle.com.

Oakland renters had the upper hand. Now, the market is turning against them

As San Francisco’s artificial intelligence boom drives up housing demand and rents, some of that pressure is moving east across the bay.

------------------------------------------------------------------------------------------------
FETCHED ARTICLE 2  [AUTO-TRIMMED — UNREVIEWED]
  !! Furniture was cut by a script keyed on this case's record, not by a person.
  !! It may still carry passages about OTHER cases from a round-up article.
  !! The full page extract is kept in staging/ if a cut needs revisiting.
  Source     ktla.com
  URL        https://ktla.com/news/california/violent-crypto-robberies-los-angeles-bay-area/
  Field      url_2
  Retrieved  2026-09-05T13:22:59+00:00 via Wayback Machine snapshot 20260407082519, deterministic extraction (HTTP None)
  Language   unknown
  Kept       paragraphs headline [0] + 1-22 of 44
  Length     4,187 chars
  Integrity  sha256 6e59a93f7d149506aa3ab7bef2879fc92e66f70a871ae2017a2b065b1cd4f39f
  Trimmed    AUTO-TRIMMED, unreviewed: kept paragraphs 1-22 plus headline [0]; dropped 0 leading and 21 trailing paragraphs. Case-term hits on page: 23.
  Note       live URL was BLOCKED on the first pass; text comes from an archived copy dated 2026-04-07
  Archive    http://web.archive.org/web/20260407082519/https://ktla.com/news/california/violent-crypto-robberies-los-angeles-bay-area/
  Caveat     retrieved from a Wayback Machine snapshot, not the live page. The
             snapshot date is in the method line; the live URL was unreadable.
------------------------------------------------------------------------------------------------

ORIGINAL (unknown, verbatim as retrieved)

Wealthy California crypto holders targeted in violent ‘wrench attacks’ | KTLA

A series of so-called “wrench attacks,” violent robberies targeting wealthy cryptocurrency holders, are making headlines after victims in Los Angeles and the Bay Area were targeted, the San Francisco Chronicle reported.

On Nov. 22, a San Francisco man was robbed of $13 million in digital currency after thieves posing as pizza delivery drivers forced their way into his home, bound him with duct tape, beat him with a firearm and threatened to cut off his fingers.

The victim told investigators he had been expecting a package when a man carrying a white box arrived on the front porch of his Mission Dolores home around 5 p.m.

He was reportedly pushed away from the door and overtaken. For the next hour, a suspect inside the home and another on the phone demanded his passwords and ultimately made off with $10 million in Bitcoin and $3 million in Ethereum, according to The Chronicle.

Experts say the decentralized nature of cryptocurrencies and the ability to transfer large sums in irreversible transactions, features that attract speculators, also make large account holders vulnerable to bad actors.

Three attempted wrench attacks in Sunnyvale, San Jose and Los Angeles that occurred in the days and weeks following the San Francisco home invasion appear to be linked.

In some cases, investigators believe suspects infiltrated victims’ DoorDash or Uber Eats accounts and obtained key information, including home addresses.

On Dec. 17, a San Jose man was met in his driveway by an armed suspect who ordered him into the garage and told him to close the door. He was struck on the back of the head with the gun and fell, later telling investigators he pretended to be seriously injured.

The suspect and another man were spooked when an Amazon delivery van drove by, prompting them to flee.

The victim also recounted two pizza deliveries to his home 11 days earlier that he had not ordered. Just two days before the attack, he was approached by individuals offering to power wash his driveway for free, an offer he declined.

Five days later in Sunnyvale, another man reported that a person posing as a DoorDash driver delivering coffee brandished a gun and pushed his way inside the victim’s home. The suspect fled in a black Kia after the victim fought back.

The suspect was later pulled over and arrested. He was identified as Nino Chindavanh, a 21-year-old resident of Tennessee.

Eight days later, a second suspect attempted the same coffee delivery ruse at the same home.

On New Year’s Eve in Los Angeles’ Brentwood neighborhood, a man posing as a delivery driver asked if he could get a drink of water. The victim obliged and was followed into the home at gunpoint.

He was bound with duct tape and zip ties by the time a second suspect arrived, while a third person was contacted by phone. The suspects threatened to cut off his fingers, prompting the victim to give up his computer password, allowing them to view his cryptocurrency holdings.

A witness hiding in a pantry during the ordeal managed to escape and call 911.

When the suspects heard a helicopter circling overhead, they attempted to flee and were later arrested following a police pursuit.

The two suspects were identified as Elijah Armstrong and Jayden Rucker, both residents of Tennessee. Rucker’s wallet and ID were also found in the black Kia Chindavanh had been driving.

While the three men have been charged with robbery, burglary, assault with a firearm and attempted extortion, among other offenses, investigators believe higher-level operatives are involved in the wrench attacks, a term derived from a web comic.

It’s unclear if investigators, including those at the Federal Bureau of Investigation, have identified any of the larger players in the scheme.

Detectives believe all suspects involved in the in-person robberies in the Bay Area and Los Angeles have now been taken into custody.

A DoorDash spokesperson told The Chronicle that the company is unable to comment on the cases as the investigation remains ongoing, but said the company is cooperating with state, local and federal investigators.

================================================================================================
generated from attacks-export-Gart-website.json + reported_K&R  |  case 422
================================================================================================