US4 min(s) read
Published 12:52 24 Jun 2026 GMT
Investigators searching for answers in the disappearance of Nancy Guthrie continue to focus on one key piece of evidence that has been available since the beginning of the case, a Bitcoin wallet provided by the people behind a ransom demand.
According to cryptocurrency specialists, the ransom communications and the wallet itself suggest the perpetrators may have been inexperienced.
Some investigators are also reportedly questioning whether a decision made early in the investigation may have cost them a valuable lead.
The case centers around a ransom email sent to Guthrie’s family demanding $4 million in cryptocurrency in exchange for her safe return.
The message reportedly included details about Guthrie’s home and an Apple Watch that had not been made public. A second email, sent from the same IP address, later claimed that Guthrie had died.
Sources familiar with the investigation told Air Mail that detectives from the FBI and the Pima County Sheriff's Department are now reconsidering their decision not to send the full ransom payment.
Instead of transferring $4 million, the FBI reportedly deposited just $152 worth of Bitcoin into the wallet. The goal was to see whether the suspects would move the funds, creating a digital trail that investigators could follow.
However, the money remains untouched.
Crypto experts say criminals seeking a large ransom would normally try to move the funds quickly.
"[The suspects] would want to get those $4 million off chain as fast as they can," said Ari Redbord, global head of policy at TRM Labs.
He explained that criminals often use mainstream cryptocurrency exchanges, adding: "They are typically using mainstream exchanges like Coinbase or Kraken that have that user information. … Law enforcement can then subpoena them for that information."
Instead, authorities chose a tactic known as "tickling the wire," which involves sending a small amount of money in the hope of triggering movement within the account.
Some experts believe the approach may have worked given what appears to be the amateur nature of the alleged kidnappers.
Attorney Todd Spodek, who specialises in cybercrime cases, argued that the circumstances suggest a lack of sophistication.
"An actual, sophisticated operation wouldn't have gotten involved in a kidnapping conspiracy turned homicide. That alone says it's rookie s**t," he said.
The investigation has already revealed footage of a suspect wearing what was described as a makeshift disguise consisting of Walmart-bought items, including gloves and a mask, while attempting unsuccessfully to disable Guthrie's doorbell camera. The individual was also reportedly carrying a firearm awkwardly tucked into their waistband.
Even if someone more technically skilled was involved, Spodek remained sceptical, describing the alleged scheme as "some f**king, and I don't know any other word than the yiddish, but some farkakte plan."
Despite the debate over the ransom strategy, both Redbord and Spodek said there were legitimate reasons for authorities not to send millions of dollars.
"Law enforcement is often placed in a Catch-22 situation, damned if they do, damned if they don't," Spodek explained.
He added that there was no guarantee the suspects would have moved the money even if the ransom had been paid.
"They could have sent a large sum of money, and it could have gone nowhere. The suspects might have panicked and left it sitting in the wallet for 10 years. Or forever. It's hard to negotiate with a terrorist. These are not rational people."
Meanwhile, investigators continue working to identify the person or people behind the emails by tracing a network of proxy servers allegedly used to conceal their identities.
Authorities have also continued to pursue several other leads, including questioning and releasing multiple persons of interest, visiting gun stores in the Tucson area, and even examining possible DNA evidence.
Despite efforts from investigators, the investigation still remains unresolved as it enters its fifth month, with detectives still searching for the breakthrough that could identify those responsible.
2 min(s) read
3 min(s) read
.webp_lli6Ty?tr=cr-74.9.445.380,f-webp,q-70,w-1024)
3 min(s) read
us3 min(s) read
us3 min(s) read
Published 17:29 16 Feb 2026 GMT
us2 min(s) read
Published 15:58 11 Feb 2026 GMT
us3 min(s) read
us3 min(s) read
Published 16:01 09 Apr 2026 GMT
Published 15:53 22 Jun 2026 GMT
One of the ransom notes sent to Nancy Guthrie's family reportedly included a harrowing apology.
The blackmail letter, sent on February 6, allegedly offered to return the 84-year-old's body in exchange for money, a source familiar with the investigation told Air Mail.
The message followed an earlier ransom note from the same sender that included details investigators believed only someone involved in the abduction would know.
The email reportedly correctly described what Today host Savannah Guthrie's mom was wearing on the night she disappeared and referenced a damaged floodlight in her backyard.
Guthrie was kidnapped from her Tucson, Arizona, home in the early hours of February 1.
Per reports, the first messages from the sender claimed that the 84-year-old was "safe but scared" and would be returned if the family paid $4 million in Bitcoin by 5PM on February 5.
The sender allegedly warned that if the money was not paid by February 9, the demand would rise to $6 million, "or else".
Investigators reportedly determined that the later "apology" note came from the same IP address as the earlier emails, leading to concerns that the messages were genuine.
That note claimed Guthrie had been "accidentally killed" and offered to return her body to the family for $4 million.
The day after the note arrived, Savannah shared a heartwrenching clip on Instagram alongside her brother, Camron, and sister, Annie.
"We received your message, and we understand. We beg you now to return our mother to us, so that we can celebrate with her," the TV host pleaded. "This is the only way we will have peace. This is very valuable to us, and we will pay."
Savannah has since said she believes the ransom notes were real.
Federal authorities are now reportedly re-examining the ransom communications as they continue scouring for clues that could identify the person responsible for Guthrie's disappearance.
Air Mail reported that investigators believe the letters suggest the sender is articulate and possesses a good understanding of cryptocurrency.
Authorities reportedly also view the apology itself as important. The wording has led some investigators to believe the suspect may not be the cartel figure they initially feared, but rather a local opportunist.
Investigators are also examining whether the abductor may have had help. A masked man was reportedly seen trying to remove Guthrie's Nest doorbell camera on the night she disappeared.
However, federal investigators told the outlet that the clumsy effort to remove or hide the camera does not appear consistent with their profile of the more calculated suspect who wrote the ransom letters.
No suspects have been publicly identified.
TMZ reports that it has received a fourth message from someone who claims to know the identity of Nancy Guthrie’s kidnapper.
This time, the person contacted the US celebrity news network with a chilling explanation for their refusal to identify themselves.
Nancy Guthrie has now been missing for over two weeks since she failed to show at a friend’s house in Arizona to watch a church service.
In that time, her family - including Today show host Savannah Guthrie - have appealed for her safe return, a video of a masked suspect has been released, and DNA evidence has been found on a glove, as well as an ominous trail of blood near to the house.
But authorities have not yet come close to finding the missing 84-year-old - although a raid was conducted over the weekend.
The FBI has issued a huge reward for information leading to the arrest of the suspect, or the safe return of Guthrie, but so far to no success.
They doubled that reward to $100,000, but haven’t received anything other than demands from a person who seems to only contact TMZ with demands.
After sending three previous notes - including one that contained some ‘ominous’ threats and a claim that they didn’t think they were ‘being taken seriously’, a fourth has been received.
This latest email contained a link to the same Bitcoin account as the previous three, and also makes a fresh claim as to how they know the identity of the masked kidnapper or kidnappers.
TMZ quotes the note as stating: "I know what I saw [five] days ago south of the border and I was told to shut up so I know who he is and that was definitely Nancy with them."
In a previous note, the person alluded to the involvement of more than one suspect, and warned ‘be prepared to go international’.
The person - reportedly a man - behind the notes claims that he has a burglary on his record from a decade ago, and doesn’t want to be implicated in this case, which is why they are scared to come forward.
They are still demanding $50,000 in Bitcoin for the information, even though the FBI reward is now double that.
In a plea to the informant, TMZ wrote: “If the individual who is writing us these emails is reading this…
“If you are for real, send us the information regarding the whereabouts of Nancy and her kidnappers.
“We will immediately forward the information to the FBI.
“If it leads to finding Nancy and/or the kidnappers, you then have a public record that you are the one responsible, thus ensuring you will get the reward.
“The FBI is aware we are making this overture.”
The case continues.
A new ransom note has been received in the case of Savannah Guthrie’s missing mom Nancy, with another very specific demand.
The note, which has now been passed to the FBI, made a sinister statement at the end that will certainly focus the bureau’s attention.
Nancy Guthrie, 84, has been missing since February 1, when she failed to show up at a friend’s house to watch a church service.
In the intervening time, ransom notes have been received containing details of a price to be paid and deadlines that have since passed.
Police have searched the area around the house, and recently released images and video that show a masked and armed suspect attempting to tamper with the doorbell camera at the property belonging to Guthrie.
A man was also arrested and questioned before being released, and so far it seems as if law enforcement are not close to apprehending any credible suspect.
Now, according to TMZ, another note has been received, with another demand that could see Guthrie returned, but a sinister threat at the end.
This time, the note contains a link to a different bitcoin wallet - the previous one demanded $6,000,000 - and a much simpler demand, which would result in the identity of the kidnappers being revealed.
It is not clear how credible this note is, but TMZ claim it has since been passed to the FBI, who will be taking it seriously.
Received at 5:00AM PST on February 11, the sender of the note - according to the reports - attempted to contact the Guthrie family, Savannah, her brother Camron, and sister Annie by email and text before sending the note to the news agency.
The note allegedly says: "If they want the name of the individual involved then I want 1 Bitcoin to the following wallet.”
It ends with the disturbing comment: “Time is more than relevant."
TMZ claims to have verified the bitcoin account as genuine, and that it is a different account to the first note received by the publication and other news stations.
The FBI is currently offering a $50,000 reward for information leading to those who allegedly took Nancy Guthrie, whereas one bitcoin is currently worth around $66,000.
Published 17:01 09 Feb 2026 GMT
A small detail in a ransom note claiming to be from Nancy Guthrie's kidnappers could reveal a key detail about the criminals.
As previously reported, the 84-year-old, who is the mother of TV news anchor Savannah Guthrie, was reported missing on February 1.
Nancy had vanished from her $1 million home in Tucson, Arizona, last weekend after being dropped off by her daughter and son-in-law, with the alarm being raised after she failed to arrive at church as expected.
A trail of blood was found outside her home, and the doorbell camera outside had also been removed in the early hours.
Her children - Savannah, Camron, and Annie - have since begged the captors to return their mother, who is without vital medication she needs daily.
Several ransom notes have surfaced since the disappearance, including one which police are taking seriously.
The alleged captors are demanding $6 million in bitcoin by 5PM on Monday, with a threat also being made to Nancy's life.
However, according to new reports, one small detail within the ransom note could suggest that the kidnappers are not in the US.
Reporter JJ McKinney, whose Arizona outlet KGUN9 was one of three to receive the ransom note, said per the New York Post: "Multiple ransom notes have been sent out to the media, including one that was sent to us.
"In the letter, the potential kidnappers demanded that the Guthries pay them $6 million before this Monday."
The purported kidnappers did not provide any proof of life or that they have Nancy, but included details from inside her house, which has prompted law enforcement to treat the demands as if they are real.
Nancy's children shared a video message to say: "We received your message, and we understand.
"We beg you now to return our mother to us so that we can celebrate with her. This is the only way we will have peace. This is very valuable to us, and we will pay.”
However, some experts have cast doubt on the ransom note, which specified that the ransom be paid in the equivalent of US dollars - which they believe could indicate that the person making the demand is not in the US, which could potentially mean it is a scam to obtain millions of dollars from the Guthries.
Former FBI agent Michael Harrigan told The New York Post: "If you’re domestic, why would you ever put ‘USD?’ You put 6 million.
"Why would you use that if you’re a domestic person? That points to somebody who might be potentially outside the country."
He added that that tiny detail "lends the potential for this being a scam."
No further communication has emerged from the supposed kidnappers as the deadline mentioned in their message draws closer.
Police have maintained a presence at Nancy's home and were seen searching a septic tank behind the property before leaving empty handed.
The same tipster that asked for a deposit of one bitcoin in exchange for information about Nancy Guthrie’s whereabouts last month has made a new shocking revelation.
The new note claims that the anonymous person saw the missing 84-year-old alive in Mexico.
On the day that her daughter Savannah Guthrie returned to anchor NBC’s Today show, the gossip site TMZ received a letter saying, "I saw her alive with them in the state of Sonora, Mexico."
Sonora is a Mexican state bordering Arizona and parts of New Mexico.
The elderly mother of the beloved news host vanished without a trace on January 31 from her home, just 70 miles from the Mexican border.
According to cops at the time, Nancy has limited mobility and is reliant on daily medication, which, if she does not take, could be fatal.
Once again received by TMZ while live on air, the mystery person offered up more information in return for bitcoin.
However, they have lowered their price this time and demanded just half a bitcoin, allowing the other half to be transferred to their account when a public arrest is made.
The first note the outlet received in February claimed: “She is dead”.
After talking about the first letter on TMZ Live by Levin, TMZ reported the mystery author had sent a second note, saying: “I saw her alive with them in the state of Sonora Mexico.“
The FBI have been hesitant to act upon the notes as there has been no deposit into the account they created for the ransom to be paid into.
The person behind the notes seems frustrated that they had been “disregarded as a scam” by investigating authorities.
“It’s unbelievable that millions have been wasted and yet here I am willing to deliver them on a silver platter since the 11th of February for a bitcoin but I am disregarded as a scam … they are free and the case is frozen but the ego’s remain hot when it comes to me,” the first letter reportedly stated.
Although the FBI is understandably cautious to hand over large sums of cryptocurrency, as the price of bitcoin drops, it is interesting that neither cops nor daughter Savannah are willing to satisfy the tipster.
While the note’s sender claimed to know valuable information, they also said they had no involvement in the “horrific crime”, insisting they had been out of the country for more than five years.
In the latest note, the person making the bombshell claims insists they are not motivated by money, saying: “I just want what's fair and to live peacefully with enough to start my life again quietly without having to join a witness protection program."
.webp_ke6C2y?tr=cr-169.8.1505.1344,f-webp,q-70,w-1024)
.webp_ke6C2y?tr=cr-169.8.1505.1344,f-webp,q-70,w-100)
.webp_lli6Ty?tr=cr-74.9.445.380,f-webp,q-70,w-100)
