$13 million S.F. crypto heist leaves trail of pizza orders, texts to escort, police reports show
The intruder said he worked for the cartel. After gaining entry to the victim’s home by posing as a courier, he bound the victim’s wrists and ankles with duct tape, doused him with an unknown liquid and threatened to burn down the house.
After more than an hour inside the Mission Dolores home, the suspect had robbed the victim of $13 million worth of cryptocurrency, pulling off a heist that recent police records suggest was far more violent and sophisticated than was previously known.
The documents, which were obtained by the Chronicle and have not been previously reported on, shed new light on the Nov. 22 robbery, revealing a coordinated plot involving multiple suspects and investigative paths that led police to a local pizza restaurant, a gay escort service and career criminal in Washington.
San Francisco police did not immediately return requests for comment on this story, but told the Chronicle late last month there had been no arrests made in the case. Police declined to provide additional comments, citing the ongoing investigation.
Officials with the FBI, which is assisting in the investigation, did not respond to requests for comment. The Chronicle is not naming the victim in the case.
The Nov. 22 incident began with a ruse, when a suspect disguised as a delivery person showed up to the victim’s house holding a package, according to the police records.
A home security video shows a suspect approaching the residence in dark-colored clothing, a hoodie and gloves, carrying a white box. The video was posted on social media by Y Combinator CEO Garry Tan, who said he was a friend of the victim. The video was subsequently deleted.
The footage, which the Chronicle reviewed and reported on at the time, showed the suspect turning his head away from the security camera as he reached the entrance and buzzed the door. The suspect asked the victim if he could “sign for this,” briefly looked through his own pocket, and then asked the victim if he had a pen.
After the resident said he’d look for one, the suspect is seen walking into the home, out of view of the camera, before a loud bang is heard. The suspect’s face is never seen in the video.
Describing the incident to police, the victim said he attempted to close the door on the fake delivery driver, but that the suspect was able to force his way inside.
The victim said he struck the suspect once, but received a return punch that knocked him to the ground. The intruder then produced a gun, and forced the victim to bind his own feet together with duct tape. After he was done, the suspect duct taped the victim’s hands.
The victim told police the intruder threatened to kill him multiple times, said he worked for the cartel and wore gloves almost all of the time he was inside the home.
As the victim lay face down in the living room, the suspect joined a phone call that sounded as though it included multiple other people, including what the victim described as an older male with a “raspy voice.”
The raspy voice on the other end of the line gave the intruder instructions. He forced the victim to unlock his phone so the intruder could transfer about $3 million in Ethereum, a cryptocurrency, out of the victim’s account, the report states.
A person on the phone then told the intruder that there was still $10 million worth of Bitcoin on the victim’s laptop – information the victim later told police was publicly known. The victim told the suspect his laptop was in his bedroom, and provided the suspect with information that allowed him to transfer the $10 million, the victim told police.
The suspect then forced the victim to crawl downstairs, and while doing so dumped an unknown liquid on him. The man told the victim he was going to burn the house down, and after the intruder left the room, the victim heard what he believed to be the suspect smashing the laptop in the kitchen area.
The suspect fled without attempting to torch the house, leaving the victim still bound with duct tape. The victim told police he waited for about five minutes before he was able to stand up, move to the kitchen and cut off the tape binding his legs. He then locked the front door and went upstairs to call for help.
Early investigative records suggest the suspect or suspects may have been casing the house for hours before the intruder ultimately gained entry at about 5 p.m.
Just after the robbery, the victim noticed that there were two pizza boxes in front of his residence that he hadn’t ordered.
Police later found that at about 12:00 p.m. and then again at about 2:40 p.m., an unknown person calling from a Los Angeles area code ordered pizzas from a nearby restaurant, paid for them with a credit card, and had them delivered to the victim’s address.
Between 2 p.m. and 4:30 p.m., just before the robbery, the victim received several calls from a different Los Angeles number from someone who claimed to be attempting to deliver a package.
Search warrants served on the wireless providers for those numbers showed that both accounts were created on Nov. 21, the day before the robbery. The search warrants opened a flurry of other investigative leads, showing text communications and phone calls with several other phone numbers on the day of the robbery, as well as other phone numbers and email addresses associated with the accounts.
Among the communications, one of the phone numbers police associated with the home invasion and robbery was used to send a text to a number with a San Francisco area code that search records showed was linked to a male escort service.
In texts that occurred hours before the robbery, the suspect phone number asked the San Francisco number “how much per hour? Are you free in an hour?” The 415 number responded “300 per hour” and “Not now but I’ll be later at night.”
Police additionally linked one of the cell phone accounts to an email address belonging to a Washington state man with a long history of criminal charges there, including one that filed two days after the robbery
The Chronicle is not naming the Washington man because he has not been accused in the San Francisco crime. It was not immediately clear what the man was recently charged with in Washington, or whether he is considered a suspect in the San Francisco case.
There is no record of the man in any recent San Francisco jail booking logs, and his name does not appear as a defendant in any San Francisco criminal cases.
This article originally published at $13 million S.F. crypto heist leaves trail of pizza orders, texts to escort, police reports show.
