The Investigative Committee said it was holding two suspects - a maintenance foreman, Valery Bashkatov, and his assistant Yury Gordov - and added that high-ranking officials could also be arrested.
"The detained have already been questioned," the committee said, noting the men will soon be formally charged with safety breaches.
Twenty-one people died and more than 200 were wounded yesterday when a metro train braked abruptly and three carriages derailed and crumpled.
The death toll from the rush hour crash has since climbed to 22, an emergencies ministry spokesman told Russian news agencies today.
Also Read
The Investigative Committee said that the metro had since May been carrying out work to install a set of points - a section of track allowing trains to change lines - to launch a section of new tracks.
The suspects had overseen the works, said the committee, which reports directly to President Vladimir Putin.
The committee said in a statement it believed "the works have not been conducted in a proper manner."
"A set of points was fixed in place with a piece of regular 3-millimetre wire which snapped."
Putin yesterday had ordered a criminal probe in the crash, the worst accident in the Moscow metro's 80-year history.
City authorities declared today a day of mourning as calls mounted to urgently improve the marble-clad but overcrowded metro, one of the world's busiest.
The subway, which first opened in 1935 under Stalin, transports some 9 million passengers every day.