Alleged Bitcoin Ransom Note Discovered in Investigation of Today Show Host Savannah Guthrie’s Missing Mother
Authorities are currently reviewing reports of a Bitcoin ransom note linked to the disappearance of Nancy Guthrie, the 84-year-old mother of Today show anchor Savannah Guthrie. The case, initially classified as a missing vulnerable adult situation due to Nancy’s age, has since escalated to a suspected abduction, with law enforcement treating it as a serious criminal investigation.
Emergence of a Bitcoin Ransom Demand
The alleged ransom note first came to public attention through TMZ, which reported that the note demands “a large” payment in Bitcoin in exchange for Nancy Guthrie’s safe return. The note reportedly includes a strict deadline and implies threats of harm should the demands not be met.
TMZ founder and host Harvey Levin commented during a segment of TMZ Live that the media outlet had promptly alerted the Pima County Sheriff’s Department and maintained contact with the detective unit. Levin emphasized that while the email had been shared with law enforcement, the authenticity of the note remained uncertain. “We don’t know whether this is legit or not,” he said.
Details of Nancy Guthrie’s Disappearance
Nancy Guthrie was last seen on the evening of January 31 at her residence in the Catalina Foothills neighborhood near Tucson, Arizona. While authorities initially listed her as missing and vulnerable, developments led investigators to categorize the case as a potential kidnapping. This shift followed the discovery of what officials described as “very concerning” evidence inside Guthrie’s home.
TMZ executive producer and co-host Charles Latibeaudiere disclosed that the ransom note contained specific details that lend some credence to its legitimacy. These included a description of the clothing Nancy was wearing when she vanished and mention of a damaged item inside the house. Moreover, the Bitcoin address included in the note was verified by TMZ as a real and functioning address, adding complexity to the case.
Law Enforcement Response
The Pima County Sheriff’s Office acknowledged the circulation of ransom note reports on social media and reassured the public that all tips and leads are being taken seriously. They stressed that information received is directly forwarded to detectives who are working closely with the FBI on the investigation. Beyond this, the sheriff’s office declined to offer further comment.
At present, authorities have not confirmed whether they believe the ransom note is genuine or a potential hoax designed to extort Bitcoin from unsuspecting individuals. Representatives for Savannah Guthrie have not responded to requests for comment.
Bitcoin in Kidnapping and Extortion Cases
The use of Bitcoin and other cryptocurrencies in ransom demands is not a new development. Originating over a decade ago with cybercrime cases involving ransomware, the tactic has expanded into physical kidnapping and extortion scenarios often referred to as “wrench attacks.”
Notable recent incidents include the April 2024 torture of a Canadian family linked to cryptocurrency access demands, and the November 2024 abduction of WonderFi CEO Dean Skurka in Toronto, who was released after a $720,000 Bitcoin ransom was paid. Similarly, in January 2025, Ledger co-founder David Balland was kidnapped in France with a ransom demand involving crypto assets. In the United States, New York prosecutors charged two men in June 2025 for kidnapping and torturing an Italian national to coerce access to his Bitcoin holdings.
Current Status
As the investigation into Nancy Guthrie’s disappearance progresses, law enforcement remains focused on gathering credible intelligence and verifying the ransom note’s authenticity. The involvement of the FBI underscores the seriousness of the situation.
The public and media outlets continue to monitor developments closely, hoping for Nancy Guthrie’s safe return. Decrypt will provide updates as more information becomes available.
For ongoing coverage and in-depth crypto-related news, subscribe to Decrypt’s newsletter.