Police arrested 26-year-old Luigi Nicholas Mangione on Monday after a McDonald's employee in Altoona, Pennsylvania, alerted authorities to a customer, who was found with a gun, mask and writings linking him to the ambush.
Mangione was ordered to be held without bail during a brief court hearing.
Asked if he needed a public defender, he asked if he could "answer that at a future date".
Mangione, who was charged with weapons, forgery and other charges, will be extradited to New York to face charges in connection with Mr Thompson's death.
The chance sighting at the restaurant led to a dramatic break in the fast-moving investigation that had captivated the public in the five days since the shooting that shook the health insurance industry.
Mangione had a gun believed to be the one used in last Wednesday's shooting of Brian Thompson, as well as writings suggesting anger with corporate America, police said.
He was sitting at a table in the rear of the McDonald's wearing a blue medical mask and looking at a laptop computer, documents said.
When an officer asked if he had been to New York recently, he "became quiet and started to shake."
In his backpack, police found a black, 3D-printed pistol and a 3D-printed black silencer, according to the documents.
The pistol had a metal slide and plastic handle with a metal threaded barrel. He was taken into custody about 9.15am, Pennsylvania police said.
"He is believed to be our person of interest in the brazen, targeted murder of Brian Thompson," New York Police commissioner Jessica Tisch said.
Mangione had clothing and a mask similar to those worn by the gunman and a fraudulent New Jersey ID matching one the suspect used to check into a New York City hostel before the shooting, Ms Tisch said.
NYPD chief of detectives Joseph Kenny said Mangione was born and raised in Maryland, has ties to San Francisco and has a last known address in Honolulu.
Police found a three-page document with writings suggesting Mangione had "ill will toward corporate America," Mr Kenny said.
The handwritten document "speaks to both his motivation and mindset," Ms Tisch said.
Mangione had a ghost gun, a type of weapon that can be assembled at home from parts without a serial number, making them difficult to trace, investigators said.
"As of right now the information we're getting from Altoona is that the gun appears to be a ghost gun that may have been made on a 3D printer, capable of firing a 9mm round," Mr Kenny said.
NYPD detectives and staff from the Manhattan district attorney's office travelled to Altoona to interview Mangione, he said.
Mr Thompson, 50, was killed last Wednesday as he walked alone to a hotel, where UnitedHealthcare's parent company, UnitedHealth Group, was holding its annual investor conference.
UnitedHealth Group thanked law enforcement in a statement issued on Monday.
"Our hope is that today's apprehension brings some relief to Brian's family, friends, colleagues and the many others affected by this unspeakable tragedy," a company spokesperson said.
The shooting shook US businesses and the health insurance industry in particular, causing companies to rethink security plans and delete photos of executives from their websites.
The gunman appeared to be "lying in wait for several minutes" before approaching the executive from behind and opening fire, police said. He used a 9 mm pistol that police said resembled guns farmers use to put down animals without causing a loud noise.
Mangione attended an elite Baltimore prep school, graduating as valedictorian in 2016, according to the school's website.
He went on to earn undergraduate and graduate degrees in computer science in 2020 from the University of Pennsylvania, a school spokesman said.
One of his cousins is a Maryland state legislator and his family bought a country club north of Baltimore in the 1980s.
On Monday, police blocked off an entrance to the property, which public records link to the suspect's parents.
In the days since the shooting, police turned to the public for help by releasing a collection of nine photos and video -- including footage of the attack, as well as images of the suspect at a Starbucks beforehand.
Photos taken in the lobby of a hostel on Manhattan's Upper West Side showed the suspect grinning after removing his mask, police said.
On Monday, police credited news outlets for disseminating the images and the tipster for recognising the suspect and calling authorities.
Investigators earlier suggested the gunman may have been a disgruntled employee or client of the insurer. Ammunition found near Mr Thompson's body bore the words "delay," "deny" and "depose," mimicking a phrase used by insurance industry critics.
The gunman concealed his identity with a mask during the shooting yet left a trail of evidence, including a backpack he ditched in Central Park, a cellphone found in a pedestrian plaza and a water bottle and protein bar wrapper that police say he bought at Starbucks minutes before the attack.