Fake DoorDash, Real Firearms, $6.5M in Stolen Crypto

What Happened

A federal grand jury indicted 3 Tennessee men on charges related to a series of violent home invasions targeting cryptocurrency holders across California. The defendants are Elijah Armstrong, 21, Nino Chindavanh, 21, and Jayden Rucker, 25, all from the Nashville area. Charges include conspiracy to commit Hobbs Act robbery, conspiracy to commit kidnapping, attempted robbery, and attempted kidnapping.

Conviction on the kidnapping conspiracy count carries a potential life sentence. Armstrong and Rucker appeared in court on May 12, 2026; Chindavanh has a status hearing scheduled for June 26.

According to the indictment, the crew operated in California from November 22 to December 31, 2025, targeting crypto holders in San Francisco, San Jose, Sunnyvale, and Los Angeles. In at least one documented incident, a victim was forced at gunpoint to access their crypto accounts, after which a co-conspirator transferred approximately $6.

5 million in digital assets to a wallet controlled by the group. The indictment was filed March 31, 2026, and first made public when the defendants appeared in court in May.

The hardware wallet is not the target. The seed phrase is. And the seed phrase is wherever you stored it.

The Attack Vector: Social Engineering Followed by Physical Force

The crew's method combined social engineering with physical violence in a sequence that is becoming more documented in physical crypto theft cases. According to prosecutors, the defendants placed real DoorDash food orders to residences near their target's home, intercepted the delivery, and then brought the food to the target's door themselves, presenting as delivery workers.

When victims opened the door, the crew forced entry. Once inside, they used firearms, duct tape, and zip ties to restrain victims before demanding access to cryptocurrency accounts and seed phrases.

The social engineering layer is specifically designed to defeat basic physical security instincts. A person seeing a delivery worker with food is not primed to treat the interaction as a security threat. This pretext works better than a direct knock because it removes the 'why are you here?'

question before it can be asked. The documented pattern across multiple incidents in this case suggests a rehearsed operational protocol rather than improvised or opportunistic violence.

Why the Seed Phrase Is the Target, Not the Device

The crew's specific demand for seed phrases tells you something precise about how this category of attacker thinks. A hardware wallet alone is useful but limited: the attacker needs that specific device, and hardware wallets include lockout protections after failed PIN attempts.

A seed phrase (the BIP-39 mnemonic from which all private keys for a wallet are derived) is the master credential. A seed phrase written on paper is all an attacker needs to restore full wallet access on any compatible device, anywhere in the world, with no time pressure. The money follows the seed, not the hardware.

Crypto theft of this kind is structurally different from traditional financial theft because the transfer is irreversible. A bank can reverse a wire; a blockchain cannot reverse a confirmed transaction. Attackers who have done enough advance research to identify and target a specific holder understand this.

When a victim is restrained and asked for their 'crypto password,' what is being demanded is the seed phrase, not the device PIN. The PIN unlocks one device. The seed phrase unlocks everything, permanently.

What This Means for You

Seed phrase backups should not be stored at your home address if your home address is associated with you as a crypto holder. A paper backup in a home safe is better than nothing, but it is a location an attacker can demand you open under duress. Geographically separating your seed phrase backup (a bank safe deposit box, a trusted location in a different city, a commercial vault facility) removes the attack surface from the one location an attacker knows to check.

BIP-39 passphrases add a second factor that does not exist on the physical backup. A seed phrase without its passphrase opens a plausible-deniability wallet with limited funds. An attacker who extracts your seed phrase and finds a wallet with modest holdings may accept that as the real wallet.

Your actual holdings, protected by the passphrase, remain inaccessible. This is the duress wallet concept in practice: a technically correct credential that opens a different account.

Counter-OSINT hygiene is the upstream defense. This crew researched its targets before arriving. The working assumption should be that anyone willing to conduct physical violence has purchased or harvested data about you: your name linked to a crypto transaction, a social media post about holdings, or a data broker record associating you with a crypto platform.

The Coinbase insider breach of May 2025 exposed personal data including names and financial account information for tens of thousands of customers. That data is in circulation. The attacker's victim selection process starts somewhere in that stream.

Multi-signature key distribution prevents any single seed phrase from being sufficient to move significant holdings. A 2-of-3 multi-sig setup across geographically separated locations means that even if you are under duress at one location and reveal one key, the attacker still cannot move the full amount without access to a second location or a second key-holder simultaneously.

For holders with substantial positions, this is the structural answer. For holders with more modest amounts, a BIP-39 passphrase plus a geographically separated seed backup provides most of the same protection at lower setup cost.

What to Watch

Watch the federal proceedings for Armstrong, Rucker, and Chindavanh. The prosecution's approach, particularly whether it applies organized crime statutes and whether it traces the stolen funds through on-chain analysis, will reveal how the DOJ is building its physical crypto theft playbook.

Also watch the CertiK and Jameson Lopp physical attack trackers, which have documented a sustained increase in incident rates since Q3 2025. Physical crypto theft causing $101 million in losses in the first 4 months of 2026 is tracking toward a record annual total. The indictment of a named, multi-city crew operating on a structured schedule is a sign that law enforcement is treating this as organized crime, not isolated incidents.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.