As the search for Nancy Guthrie extends into a second week, more details are emerging about an alleged ransom note demanding a crypto payment. A local Arizona TV station, KGUN9, reported that the alleged kidnappers have demanded $6 million in a Bitcoin payment.
The purported captors demanded that the payment be made by 5 p.m. on Monday, on pain of Guthrie’s life. Savannah Guthrie and her siblings said they would pay a ransom in a video posted to Instagram over the weekend. (Update: The 5 p.m. deadline passed without news of further contact from the alleged kidnappers as of Monday evening).
KGUN9 declined to share any further details about the ransom letter in a note to Fortune. Law enforcement has not said that the ransom letter is legitimate.
In order to pay the ransom, the Guthrie family would have to acquire Bitcoin, typically by opening an account with a crypto exchange, according a spokesperson at the blockchain analysis firm Chainalysis. The family could also send the money through an intermediary. In either case, they would then transfer the requested amount to the wallet address provided by the captors.
Bitcoin addresses, which are public, are long strings of random numbers and characters that can only be opened with a corresponding private key controlled by the wallet owner.
The public nature of Bitcoin’s blockchain means it’s possible to watch funds move on so-called explorer sites like this one. While the public record does not include explicit names or locations, blockchain forensics firms are often able to associate addresses with certain crypto exchanges or criminal gangs. In some cases, law enforcement can intervene to seize funds or intercept a transaction.
“Prompt response from exchanges and law enforcement is the only hope to stop the money,” said Nicholas Smart, VP of a blockchain investigations company called Crystal Intelligence.
In the case of the Guthrie abduction, one retired FBI agent told the New York Post that the ransom note has an unusual attribute—namely it includes the term “USD” for dollars, which he said an American would be unlikely to use. The former agent suggested this could mean the kidnappers may be from overseas or that the note is a hoax.
A second note has been conclusively found to be fake, and led to the arrest of the sender, but for now authorities appear to be treating the KGUN9 one as plausible.
An uptick in crypto-related violence
Nancy Guthrie, the mother of Today show cohost Savannah Guthrie, was last seen on Saturday, Jan. 31. The following day, after Nancy Guthrie was not seen at church, her family went to her home and found her phone, wallet, and daily medication but did not find her.
It is widely believed that Guthrie was taken from her home against her will. Blood was spotted at the house and there were other signs of forced entry. The Pima County sheriff’s office did not immediately respond to a request for comment.
President Donald Trump said “we have some clues” about the disappearance and that answers could be coming up “fairly soon,” while speaking with reporters on Air Force One on Friday. He called the disappearance a “horrible situation.”
Violent attacks demanding crypto payments, often called “wrench attacks,” have been on the rise in the last few years. Criminals usually target people who have publicly boasted about their crypto winnings, and physically coerce them to give up their Bitcoin key. The case involving Nancy Guthrie appears to be much different considering that there is no evidence she has any crypto wealth.
