[9] Two days after the attack, in a joint operation carried out by the Shin Bet, the Israel Police, and the IDF, Muhammad Mafarji, 18, of Tayibe, a West Bank-born Palestinian originally from Beit Liqya who had received Israeli citizenship for family reunification purposes, was arrested.

[1][10][11] According to Israeli security officials, Mafarji was a member of a Palestinian militant cell based in the West Bank town of Beit Liqya, which has links to Hamas and Islamic Jihad.

According to Israeli officials, during the sixth day of Operation Pillar of Defense, Mafaraji was shopping at a West Bank grocery store owned by Musa, and expressed his desire to fight alongside Hamas.

Moussa prepared a bomb that could be detonated by cell phone and hid it in a bag of clothes, then took Mafaraji to the Harbata checkpoint, where he crossed into Israel to meet with the manager of the McDonald's where he worked.

[11][13] On December 19, 2012, Muhammad Mafaraji was charged in the Tel Aviv District Court with attempted murder, aiding the enemy during wartime, and conspiracy to commit a crime.

In December 2013, he reached a plea bargain with prosecutors, under which he pleaded guilty to attempted murder and aiding the enemy in exchange for the prosecution not seeking a sentence greater than 25 years.

[18] On October 22, 2013, Shin Bet announced that Mohammed Assi, an Islamic Jihad member, died in a firefight in Bilin with forces that had come to arrest him on suspicion of his involvement in the bombing.