Luigi Nicholas Mangione has been charged with murdering UnitedHealthcare’s CEO Brian Thompson.
Police arrested Mangione on Monday after a McDonald’s employee in Pennsylvania alerted authorities to a customer, who was found with a gun, mask and writings linking him to the ambush.
The 26-year-old, who was charged earlier in Altoona with weapons, forgery and other charges, will now be extradited to New York.
The chance sighting at the restaurant led to a dramatic break in the fast-moving investigation.
Officer Tyler Frye, who has only been on the job for about six months, and a fellow officer responded to the McDonald’s where the suspect was spotted.
They asked him to pull his blue medical mask down and “recognised him immediately”.
Officer Frye said: “We didn’t even think twice about it, we knew that was our guy.
“It feels good to get a guy like that off the street, especially starting my career this way, it feels great.”
Brian Thompson shooting – what we know
Court documents said Mangione began shaking when the officers asked if he had been in New York recently.
Governor Josh Shapiro said that “in some dark corners, this killer is being hailed as a hero”.
“Hear me on this, he is no hero,” the Democrat added.
“The real hero in this story is the person who called 911 at McDonald’s this morning.”
NYPD chief of detectives Joseph Kenny said Mangione was born and raised in Maryland, has ties to San Francisco and has a last known address in Honolulu.
Police found a three-page document with writings suggesting Mangione had “ill will toward corporate America”, Mr Kenny said.
Following the arrest, his family released a statement that said: “Unfortunately, we cannot comment on news reports regarding Luigi Mangione.
“We only know what we have read in the media. Our family is shocked and devastated by Luigi’s arrest. We offer our prayers to the family of Brian Thompson and we ask people to pray for all involved.
“We are devastated by this news.”
Mr Thompson, 50, was killed last Wednesday as he walked alone to a hotel, where UnitedHealthcare’s parent company, UnitedHealth Group, was holding its annual investor conference.
Footage showed the attacker walking up slowly behind Mr Thompson and opening fire outside the Hilton hotel in what has been described as a “premeditated, preplanned targeted attack”.
Shell casings found at the scene where the executive was killed had “deny”, “delay”, and “depose” written on them.