In brief
- An alleged ransom note demanding millions in Bitcoin has surfaced in the investigation into Nancy Guthrie’s disappearance.
- The Pima County Sheriff’s Office said it is reviewing all tips and coordinating with the FBI, but declined further comment.
- Authorities believe Guthrie was abducted and are treating the case as a criminal investigation.
An alleged ransom note demanding Bitcoin has surfaced in the investigation into the disappearance of Nancy Guthrie, the 84-year-old mother of Today show anchor Savannah Guthrie, as authorities continue to treat the case as a suspected abduction.
The note, first reported by TMZ, is allegedly demanding “a large” Bitcoin payment in exchange for Guthrie’s release. The ransom note emailed to TMZ reportedly includes a deadline and an implied threat against Guthrie if the demand is not met.
“We have called the sheriff’s department. We’ve made multiple calls and spoken with the detective unit,” TMZ founder and host Harvey Levin said during a segment of TMZ Live. “We have passed on this email. We don’t know whether this is legit or not.”
Guthrie was last seen on the evening of January 31 at her home in the Catalina Foothills area of Arizona.
Authorities initially classified her as a missing vulnerable adult because of her age, before announcing on February 2 that the case was being treated as a “possible kidnapping” after investigators found what they described as “very concerning” evidence inside the home.
TMZ’s Levin said that media outlets receiving these types of ransoms are not uncommon and “happen from time to time.”
Law enforcement has not confirmed whether they believe the ransom note is actually from the kidnappers or a hoax to steal Bitcoin.
The Pima County Sheriff’s Office declined to comment further when contacted by Decrypt, but pointed to a statement previously issued on social media.
“We are aware of reports circulating about possible ransom note(s) regarding the investigation into Nancy Guthrie,” the sheriff’s office wrote Tuesday on X. “We are taking all tips and leads very seriously. Anything that comes in goes directly to our detectives, who are coordinating with the FBI.”
While the authenticity of the ransom note has not been confirmed, TMZ executive producer and co-host Charles Latibeaudiere said the messaging included a real Bitcoin address.
“One thing we should say is that we have confirmed the Bitcoin address that they've included is legit,” he said. The note also included a description of what Guthrie was wearing at the time and a damaged item in the house, TMZ said.
Decrypt has reached out to TMZ to confirm the address's authenticity and will update this article should they respond. Representatives for Savannah Guthrie did not immediately respond to Decrypt's request for comment.
Bitcoin kidnappings and extortion
The use of Bitcoin in ransom demands dates back more than a decade, when early ransomware strains began demanding crypto payments to unlock encrypted files. The model later became widespread across cybercrime.
In recent years, that tactic has increasingly appeared in physical kidnapping, turning into so-called “wrench attacks” and extortion cases.
In April 2024, a Canadian family was tortured by assailants who demanded access to their crypto holdings. In November 2024, WonderFi CEO Dean Skurka was abducted in Toronto and released after a $720,000 ransom was paid.
Two months later, Ledger co-founder David Balland was kidnapped in France, which included a crypto ransom demand.
In the U.S., New York prosecutors in June of last year charged two men with kidnapping and torturing an Italian national for weeks in an alleged attempt to force access to his Bitcoin holdings.