Two Muslim brothers carried out two of the hotel suicide blasts in Sri Lanka on Easter Sunday, part of a wave of bombings that killed 359 people.
The sons of a wealthy Colombo spice trader were among suicide bombers, who hit three churches and three luxury hotels, investigators said on Tuesday.
An attack on a fourth hotel failed and helped lead police to the Islamist group now blamed for the assault, they added.
The brothers, whose names have not been revealed, were in their late twenties and operated their own "family cell", an investigation officer said.
The pair were key members of the Islamist National Thowheed Jama'ath (NTJ) group which the government has blamed for the attacks, the official added.
The Islamic State group has claimed responsibility for the attacks, but the government has blamed the NTJ.
One brother checked into the Cinnamon Grand hotel, and the other the Shangri-La on Saturday.
The next morning, at virtually the same time, they went to the hotels' Easter Sunday breakfast buffets, and blew up explosives-laden backpacks, the officer said.
Another bomb tore through a restaurant at the nearby Kingsbury hotel.
Minutes before, similar explosions devastated three churches.
Investigators said that it was not known whether the brothers were in contact with the other bombers.
Another would-be suicide bomber walked into a fourth luxury hotel in Colombo on Sunday, official sources said.
"This man had also checked into the hotel the previous day," the source said.
It was not known if his explosives failed or he had a change of heart.
But after the Shangri-la blast, staff at the unnamed hotel became suspicious and the man was tracked to a lodging near the capital. He blew himself up there when confronted by police, the source added. Two bystanders were also killed.
"What we have seen from the CCTV footage is that all the suicide bombers were carrying very heavy backpacks. These appear to be crude devices made locally," it said.
With 359 people confirmed dead, including 34 foreign nationals, and over 500 wounded, Sri Lanka has declared a state of emergency and launched a desperate hunt to head off more attacks.
The whereabouts of the brothers' parents were unknown. But the blasts had a further impact on the family.
One brother gave false identity details when he checked into the hotel, the investigator said. The other gave a real address, which led police commandos to their family home in a commercial area of Colombo.
"When the Special Task Force went there to investigate, one brother's wife set off explosives killing herself and her two children," the officer said.
"It was a single terror cell operated by one family," the investigator said.
"They had the cash and the motivation. They operated the cell and it is believed they influenced their extended family," he added.
Three police commandos were killed in the blast, and several extended family members are among those in detention.
The brothers had been involved in their father's lucrative spice export business, investigators said.
A focus of the inquiry will be to find out whether there was a foreign influence in their radicalization, and how the children of such a wealthy family had become involved, an official source said.
"What we have gathered so far is that they had indicated to their close family what they were going to do," another senior police officer said.
"It looks like they were inspired by foreign terrorist groups, but to what extent they had direct links is still unclear," he further said.