A reported Bitcoin ransom note has become a central focus in the investigation into the disappearance of Nancy Guthrie, the mother of NBC “Today” co-host Savannah Guthrie, as law enforcement in Arizona works to determine whether the message is authentic and linked to a suspected kidnapping.
The case, unfolding in Pima County, Arizona, has drawn national attention due to both the victim’s public profile and the alleged use of cryptocurrency in a ransom demand.
The Pima County Sheriff’s Department confirmed Tuesday that it is aware of information regarding a Bitcoin ransom note reportedly obtained by TMZ.
Authorities stressed that the investigation remains active and that no determination has been made about the legitimacy of the alleged message, which reportedly demanded a multimillion-dollar payment in Bitcoin tied to a specific wallet address.
Law enforcement responds to reported Bitcoin ransom note
In a public post on X, the sheriff’s department said it is “aware of the ransom note(s) for Nancy Guthrie,” signaling that the reported Bitcoin ransom note is being reviewed alongside other evidence.
TMZ reported that it received the message directly and immediately contacted law enforcement after reviewing its contents.
During a segment of TMZ Live, founder Harvey Levin explained the outlet’s actions after receiving the message.
“We have called the sheriff’s department. We’ve made multiple calls and spoken with the detective unit. We have passed on this email. We don’t know whether this is legit or not,” — Harvey Levin, Founder, TMZ.
TMZ stated it verified that the Bitcoin wallet address referenced in the alleged Bitcoin ransom note exists on the blockchain.
However, authorities have not confirmed whether the wallet is connected to criminal activity or whether any funds have been transferred.
Law enforcement officials declined to disclose details about the ransom demand, including the amount requested or any deadlines mentioned, citing the sensitivity of the ongoing investigation.
Nancy Guthrie disappearance treated as forced abduction
Nancy Guthrie was last seen Saturday night at her home in the Catalina Foothills area near Tucson.
After family members reported her missing on Sunday, deputies responding to the residence discovered what authorities described as a “very concerning” scene, prompting an immediate criminal investigation.
Sheriff Chris Nanos said investigators believe Guthrie did not leave voluntarily, reinforcing concerns raised by the alleged Bitcoin ransom note.
“We do believe that Nancy was taken from her home against her will, and that’s where we’re at,” — Chris Nanos, Sheriff, Pima County.
Investigators collected DNA samples from the property and submitted them for laboratory analysis. While some results have been returned, officials said they have not yet identified suspects.
Federal investigators later released the home back to the family, though authorities declined to discuss whether there were signs of forced entry or physical struggle.
Nanos emphasized that narrowing the timeline too aggressively could harm the investigation.
“I don’t really want to get into narrowing down the time, because narrowing it down means we can miss some tips and leads,” — Chris Nanos, Sheriff, Pima County.
Authorities noted that Guthrie has mobility challenges, making it unlikely she left the residence on her own. They also clarified that she does not suffer from mental health issues.
Bitcoin ransom note raises broader crypto crime concerns
The reported Bitcoin ransom note has renewed attention on the growing use of cryptocurrency in extortion and kidnapping cases.
While crypto transactions can be traced publicly, criminals often rely on the perception of anonymity and the difficulty of recovering funds once transferred.
In her first public comments since her mother’s disappearance, Savannah Guthrie addressed the public during NBC’s morning broadcast, asking for prayers and support.
“Thank you for lifting your prayers with ours for our beloved mom, our dearest Nancy, a woman of deep conviction, a good and faithful servant,” — Savannah Guthrie, NBC News.
The alleged Bitcoin ransom note also echoes a broader trend identified by U.S. and international law enforcement agencies.
A 2025 review by NBC News documented 67 crypto-related kidnappings across 44 countries, with incidents increasing steadily since 2019. In 2024 alone, at least 17 such cases were reported, marking the highest annual total on record.
One prominent U.S. case occurred in May, when authorities arrested two men in New York accused of kidnapping and torturing a victim while attempting to gain access to his Bitcoin holdings.
Investigators described the incident as part of a wider pattern of so-called “wrench attacks,” where physical violence is used to extract crypto credentials.
NBC News identified more than 150 alleged crypto-linked extortion and assault cases globally over the past decade, involving tactics ranging from blackmail and home invasion to armed robbery and, in extreme cases, murder.
As investigators continue to examine whether the Bitcoin ransom note connected to Nancy Guthrie is credible, authorities are urging anyone with information to come forward.
For now, the case underscores both the personal tragedy facing the Guthrie family and the evolving role of cryptocurrency in modern criminal investigations.