Three arrests have been made and authorities are reportedly still looking for the criminal or criminals in charge of a crypto theft ring that allegedly plotted "wrench attacks" on multiple holders of cryptocurrency fortunes on the West Coast.

Three Tennessee men have been arrested in connection with a November home-invasion robbery at a home near Dolores Park, where a man posing a package delivery person strong-armed his way into the home and violently assaulted a victim until he revealed passwords to multiple crypto accounts. The thief, who appeared to be working other remote accomplices, reportedly made off with $13 million in cryptocurrency, and it's unclear if any of that has been recovered.

The Chronicle now reports that the three suspects, working with a higher-level ringleader or multiple ringleaders, are suspected in a string of crypto robbery plots, with the November theft in San Francisco being the only successful one. The trio conducted or attempted multiple so-called wrench attacks — named for this web comic that jokes about the most practical way to steal a person's crypto wealth involves a $5 wrench and violence — in Sunnyvale, San Jose, and Los Angeles, all around the same time as the SF incident.

The three suspects have been identified as 21-year-old Nino Chindavanh, Elijah Armstrong, and Jayden Rucker — both of whose ages haven't been publicized — who are all residents of Tennessee and clearly working together. Rucker's wallet was allegedly found by police in a car being driven by Chindavanh after he was arrested in Sunnyvale following an alleged attack there on December 22. And Armstrong and Rucker were arrested together in Los Angeles the week after Christmas after a foiled home invasion there.

Per the Chronicle report, which comes from police documents and sources close to the investigation, the trio used the same basic methods in all of the attacks. They or their higher-ups allegedly hacked into the victims' UberEats or DoorDash accounts, after identifying the victims as holders of large crypto sums. They then would pick up similar food or beverage orders from the businesses involved and make deliveries to the victims' homes when they were expecting them.

In the case of the San Francisco plot, two pizzas were found outside the victim's home, which were part of some backup plan, because the suspect in that case succeeded in getting the victim to the door with a fake UPS delivery instead. As we learned in a February report, the suspect, after binding the victim with duct tape, contacted another man with a reportedly raspy voice on the phone who gave instructions for logging into the victim's accounts and transferring funds — a total of $13 million.

In the Los Angeles incident in late December, the suspect brought a package to the victim's Brentwood home, and while at the door, asked if he could have a glass a water. The victim complied, and the suspect followed him into the house, pointed a gun at him, and bound him in zip ties, demanding his crypto passwords.

A second suspect arrived, and as happened in the San Francisco attack, the pair called a third operative over the phone who gave instructions about logging into the crypto account. According to police, the other operative may have been using a voice modulator to disguise their voice, and they became angry when it appeared that the account they logged into didn't show the real sum they believed the victim to have. This other suspect told the two suspects in the room to cut off the victim's fingers until he gave up his real account, but at that point, the suspects were spooked by a helicopter overhead and fled the house.

The police had, in fact, been called by a female witness who was hiding a pantry, as the Chronicle reports, and this led to the arrests of Rucker and Armstrong.

Chindavanh was arrested after pushing his way into the Sunnyvale victim's home with a DoorDash coffee order, and brandishing a gun. The victim in that case pushed back, and Chindavanh, only to be arrested by Santa Clara County

As we learned earlier, authorities have linked at least one of the phone numbers used in the San Francisco heist to a Washington state man who has not been publicly identified, but who apparently has a "long history of criminal charges." That man be in fact be the ringleader of the operation, who employed lower-level operatives to conduct the riskiest aspects of the crimes.

As the Chronicle notes, the nature of crypto allows authorities to theoretically trace any transactions that have taken place, and to recover stolen sums, though it's not clear that this has happened yet in this case.

All together, the cases highlight the vulnerability of those who hold crypto wealth, and whose identities can be easily traced to that wealth.

Previously: Details Emerge In November Home Invasion Crypto Robbery In SF

Top image: Doorbell camera footage of the masked suspect in the San Francisco case.