Someone sent an email to Greg Biffle's account shortly after the retired NASCAR driver died in a plane crash. The message, recovered through search warrants, read: "I heard you're dead, rest in hell." Within hours, investigators say, the looting began.
Biffle, 55, died Dec. 18 along with six others when the plane crashed. In the days and weeks that followed, people the family trusted allegedly drained bank accounts, hacked emails, and eventually broke into the Biffle home in Mooresville, North Carolina, to clean out a safe. Detectives in Iredell County now believe the burglary was not a random crime of opportunity but the final move in a broader, coordinated fraud scheme that started almost immediately after the crash.
The Sun reported that people described as friends of Biffle and his partner, Cristina Grossu, allegedly launched what investigators have characterized as a strategic strike to steal money following the family's death. Search warrants paint a picture of suspects who moved fast, knew exactly where to look, and exploited the chaos of a grieving community.
The burglary at Biffle's Mooresville home was reported Jan. 8, roughly three weeks after the crash. Breitbart reported that Iredell County Sheriff Darren Campbell said investigators believe someone entered a safe inside the home and took approximately $30,000 in cash, along with guns, memorabilia, and a backpack.
No one was in the home at the time. Authorities said the house was last known to be secure on the afternoon of Jan. 7. The window between that confirmation and the Jan. 8 report gave detectives a narrow timeline to work with.
Sheriff Campbell told reporters at the time that the investigation was in its early stages.
"We're working the case. We are waiting on some digital evidence."
That digital evidence, it turned out, would reveal a trail far more disturbing than a single burglary.
Detectives quickly zeroed in on a troubling detail: the person who entered the home appeared to know exactly where to go. The New York Post reported that investigators believe the burglary was an inside job because the suspect demonstrated familiarity with the home's layout, camera locations, closet, and safe room. This was not someone fumbling through an unfamiliar house in the dark.
Search warrants link a woman described as a friend of the family to the break-in. Surveillance footage and license plate reader data placed her vehicle near the Biffle home before the burglary occurred. Detectives traced the connection through automated plate readers, a tool law enforcement increasingly relies on to build timelines around crime scenes.
The suspect's apparent knowledge of the security setup suggests she had been inside the home before, likely as a guest. For investigators, that detail transformed the case from a property crime into something far more personal and calculated.
The burglary now appears to have been only one piece of a larger operation. Search warrants obtained by WBTV, reviewed by Fox News, indicate that hundreds of thousands of dollars were allegedly stolen from Biffle's accounts through fraudulent transactions in the days and weeks after the crash.
The financial assault reportedly began within hours of the Dec. 18 crash. Authorities say the family's email and banking accounts were targeted almost immediately. At least one fraudulent check was cashed from an account tied to Biffle's business interests, and investigators believe the family's bank accounts were compromised before the physical break-in ever took place.
That sequence matters. It suggests the people behind the scheme had access to sensitive financial information and moved to exploit it the moment they learned the family could no longer protect itself. The physical burglary, weeks later, may have been a final grab for whatever cash and valuables the electronic theft could not reach.
The investigation has expanded well beyond Iredell County. Detectives told WBTV that the case involves suspects scattered across state lines.
"There are multiple suspects over multiple states. We can't say they're not connected, but we're still investigating."
That statement from Iredell County detectives carries a careful hedge, but the implication is clear. Investigators have not ruled out coordination among the suspects. The geographic spread of the alleged participants suggests a network rather than a single opportunist acting alone.
Detectives are now working to determine whether the burglary and the alleged bank fraud were planned together or whether separate individuals exploited the same tragedy independently. Either answer paints an ugly picture. If the crimes were coordinated, someone in the family's inner circle organized a multi-state theft ring targeting a dead man's estate. If they were independent, multiple people the Biffles trusted decided to rob them within hours of learning they had died.
Among the most disturbing details in the search warrants is the email sent to Biffle's account. The message, "I heard you're dead, rest in hell," arrived shortly after the crash. Investigators recovered it through warrants and consider it part of the broader pattern of account compromise.
The email suggests the sender knew about the crash quickly and felt emboldened enough to taunt a dead man through his own hacked account. Whether the sender is the same person who drained the bank accounts or a separate actor remains under investigation. But the message establishes a timeline: someone with hostile intent accessed Biffle's digital life almost immediately after the plane went down.
That speed is what troubles investigators most. The crash happened. The email followed within hours. The financial fraud began. And weeks later, someone walked into the house, bypassed the security system, and emptied the safe. Each step built on the last.
Authorities have not publicly confirmed whether any arrests are imminent. No charges have been announced in connection with the fraud allegations, and investigators have not said whether the woman linked to the burglary through surveillance footage has been formally named as a suspect or merely a person of interest.
Detectives will need to determine how the suspects gained access to the family's financial accounts and email credentials. They will also need to establish whether the information was shared among the alleged participants or obtained independently. The fraudulent check tied to Biffle's business interests raises questions about who had signing authority or account access before the crash.
Investigators have not publicly released the total dollar figure allegedly stolen across all the fraudulent transactions. Search warrants reference hundreds of thousands of dollars, but the final accounting may take months to complete as banks and financial institutions cooperate with law enforcement across multiple jurisdictions.
Greg Biffle raced in NASCAR's top series for over a decade, winning 19 Cup Series races during a career that made him one of the sport's recognizable names. He and Cristina Grossu were among the seven people killed in the Dec. 18 crash. The family left behind a home full of racing memorabilia, a business portfolio, and a circle of people they apparently trusted.
That trust, investigators allege, was weaponized before the family was even buried. The speed and precision of the alleged scheme suggest planning, access, and a willingness to exploit grief and chaos for financial gain.
When the people closest to a family are the ones investigators suspect of robbing it, the case stops being about property crime. It becomes a test of whether the legal system can hold opportunists accountable when the victims are no longer alive to demand justice.
