A kidnapping case in Tucson, Arizona has drawn national attention after the abductors demanded $6 million in Bitcoin. Nancy Guthrie, the 84-year-old mother of NBC Today anchor Savannah Guthrie, was taken from her home in the early hours of Feb. 1, according to the reports cited in the source material.
Family members last saw Nancy Guthrie on Jan. 31. When relatives went to check on her the next day, they found her phone, wallet, and daily medication still inside the house, while she was gone. Investigators also found blood and signs of forced entry. Pima County Sheriff Chris Nanos quickly classified the case as a kidnapping. On Feb. 2, local station KOLD-TV in Tucson received an anonymous ransom letter directing the family to send Bitcoin to a specified wallet address before a deadline, with threats that the victim could be killed if payment was not made.
Bitcoin demand may have created a traceable trail
The ransom demand has pushed blockchain forensics into the spotlight. Crypto analysts cited in the coverage said Bitcoin is not anonymous but pseudonymous. Every transfer is permanently recorded on a public blockchain ledger. Wallet addresses do not directly reveal a person's identity, but investigators and forensic firms can map transactions, cluster related addresses, and connect certain flows to exchanges or criminal networks.
One point emphasized in the reports is practical rather than theoretical. If funds tied to a ransom wallet move through a regulated exchange, law enforcement can seek records tied to KYC procedures, including a user's real name and date of birth. Compared with a cash handoff, a Bitcoin payment can leave a durable chain of evidence. The source also notes that mixers can complicate tracing, though that does not erase the visibility of on-chain activity.
$152 transfer triggered closer wallet monitoring
Fortune reported on Feb. 11 that the wallet linked to the ransom letter later received a small Bitcoin deposit worth just $152. The amount was minor. The investigative value was not. That transaction reportedly activated more intensive blockchain surveillance around the address.
The report described the transfer as a possible “digital smoking gun,” because any interaction with the wallet can be flagged and followed in real time. If the funds originated from an exchange, investigators may be able to work backward or forward from that point. Even where assets are moved across multiple transactions or routed through obfuscation tools, blockchain analytics firms can still examine behavioral patterns and address relationships.
Separate fake extortion texts led to an arrest
The case was further complicated by an alleged copycat extortion attempt. On Feb. 5, the FBI arrested 42-year-old Derrick Callella of California, accusing him of sending text messages through a virtual number to Nancy Guthrie's daughter and son-in-law. One message said, “Did you get the Bitcoin? We are waiting on the transaction.”
Federal investigators said those texts were not connected to the original ransom letter. According to the FBI, Callella was trying to exploit the case by posing as one of the kidnappers. He was charged with two federal counts, including transmitting a demand for ransom and making anonymous harassing communications. After appearing in court, he was released on bond under conditions that included no contact with witnesses or victims and the surrender of electronic devices for monitoring.
FBI raises reward as search enters third week
As of Feb. 15, Nancy Guthrie had still not been found. The FBI increased its reward from $50,000 to $100,000 and released details from surveillance footage describing a suspect as roughly 5-foot-9 to 5-foot-10, medium build, carrying a black 25-liter Ozark Trail Hiker Pack backpack.
Investigators also recovered DNA that did not belong to Nancy Guthrie or her relatives from her residence. Multiple gloves were found in the surrounding area, with the farthest located about 16 kilometers from the home. On Feb. 13, a SWAT team executed a search warrant at a property about 3 kilometers away. A man previously identified as a person of interest was briefly detained and then released. The White House said the FBI would commit all available resources to the investigation. The source also noted that on Polymarket, 78% of bettors expected a suspect to be arrested before the end of February.