As the search for Nancy Guthrie continues into its second week, more details have emerged regarding an alleged ransom note that demands a cryptocurrency payment. Local Arizona television station KGUN9 has reported that the alleged kidnappers are demanding $6 million in Bitcoin.
The purported captors set a deadline of 5 p.m. on Monday for the payment, threatening Guthrie’s life if it was not met. Savannah Guthrie and her siblings stated over the weekend that they would pay a ransom in a statement posted to social media. (Update: As of Monday evening, the 5 p.m. deadline had passed without any further contact reported from the alleged kidnappers).
KGUN9 declined to provide additional details about the ransom letter in a communication to The New York Times. Law enforcement has not confirmed the legitimacy of the ransom letter.
According to a spokesperson from the blockchain analysis firm Chainalysis, to pay the ransom, the Guthrie family would need to acquire Bitcoin, typically by establishing an account with a cryptocurrency exchange. Alternatively, the family could facilitate the transfer through an intermediary. In either scenario, the funds would then be transferred to the wallet address provided by the captors.
Bitcoin addresses are publicly visible and consist of lengthy sequences of random numbers and characters. Access to these addresses is exclusively controlled by the corresponding private key held by the wallet owner.
The transparent nature of the Bitcoin blockchain allows for the tracking of fund movements on explorer sites. While these public records do not explicitly identify individuals or locations, blockchain forensics firms can often link addresses to specific crypto exchanges or criminal organizations. In certain situations, law enforcement agencies can intervene to seize funds or intercept transactions.
Nicholas Smart, VP of blockchain investigations company Crystal Intelligence, stated, “Prompt response from exchanges and law enforcement is the only hope to stop the money.”
Regarding the Guthrie abduction, a retired FBI agent informed The New York Times that the ransom note contained an unusual element: the inclusion of the term “USD” for dollars, which he noted an American would be unlikely to use. The former agent suggested this could indicate that the kidnappers are from overseas or that the note is a fabrication.
A second note has been definitively identified as fake, leading to the sender’s arrest. However, authorities currently appear to be treating the note reported by KGUN9 as potentially credible.
An increase in crypto-related violence
Nancy Guthrie, the mother of Today show cohost Savannah Guthrie, was last seen on Saturday, January 31. The following day, after Nancy Guthrie did not appear at church, her family visited her home and discovered her phone, wallet, and daily medication, but she was not present.
It is widely believed that Guthrie was forcibly taken from her residence. Blood was found at the house, along with other indications of forced entry. The Pima County sheriff’s office has not yet responded to a request for comment.
President Donald Trump commented on Air Force One on Friday that “we have some clues” regarding the disappearance and that answers might be forthcoming “fairly soon.” He described the situation as “horrible.”
Violent incidents demanding cryptocurrency payments, often referred to as “wrench attacks,” have seen an increase in recent years. Criminals typically target individuals who have publicly disclosed their cryptocurrency gains and then physically coerce them into revealing their Bitcoin keys. The case involving Nancy Guthrie appears to differ significantly, as there is no evidence suggesting she possesses any cryptocurrency wealth.