Ransom Note in Disappearance of Nancy Guthrie Suggests She May Have Been Moved from Arizona, as FBI Probes Multiple Demands for Millions in Bitcoin

Authorities investigating the suspected abduction of 84-year-old Nancy Guthrie, mother of NBC “Today” show co-anchor Savannah Guthrie, are examining ransom communications that include demands for millions of dollars in Bitcoin and details hinting the victim may no longer be in Arizona. The developments come as the search enters its second week, with no confirmed sightings of Guthrie and growing concern over her medical vulnerabilities.

Nancy Guthrie vanished from her home in the Catalina Foothills area of Tucson on the night of January 31, 2026, after being dropped off following a family dinner. Relatives reported her missing the following afternoon when she failed to attend church. Investigators quickly determined foul play was involved, citing blood confirmed to be hers at the scene, a disconnected doorbell camera, and her pacemaker app no longer active on her phone. Her wallet, cellphone, and vehicle were left behind, and officials have described the residence as a confirmed crime scene indicating she did not leave voluntarily.

The FBI’s Phoenix Field Office took the lead, classifying the case as a possible kidnapping of a vulnerable adult. A $50,000 reward remains in place for information leading to her safe recovery or the arrest and conviction of those responsible. Authorities have consistently stated they believe Guthrie is alive, though they have not released proof of life and stress the urgency of her need for daily heart medication.

Multiple purported ransom notes have surfaced since early February, sent to media outlets including TMZ, Tucson station KOLD 13, and others. The first notable communication, received by TMZ on February 3, demanded a substantial sum – reported in the millions – in Bitcoin, directed to a verified cryptocurrency address. The note included a deadline of 5 p.m. local time on February 5, with a second deadline set for February 9. It warned of escalating consequences if payments were not made, though specifics of threats were not detailed publicly.

Sources familiar with the note described it as “carefully crafted,” containing non-public details about the crime scene. These included references to a broken floodlight at the rear of Guthrie’s home – investigators confirmed two floodlights were damaged and dangling – and specifics about an Apple Watch she was not wearing at the time of her disappearance. One report indicated the note claimed Guthrie was “safe but scared” and aware of the demands being made on her behalf. It also stated this would be the only communication, with no further negotiation or contact information provided.

A subsequent message arrived at KOLD 13 on February 6, which the station forwarded immediately to the FBI and Pima County Sheriff’s Department. Officials issued a joint statement confirming they were “actively inspecting the information provided in the message for its authenticity.” While details of this second note remain limited, it reportedly included elements intended to link it to the prior communication, suggesting the sender aimed to prove legitimacy.

The inclusion of insider knowledge has led some law enforcement sources to speculate that the abductor – or abductors – may have local ties to the Tucson area. However, the method of delivery (anonymous emails and tip lines) and the demand for untraceable cryptocurrency have raised questions about whether Guthrie remains in Arizona. One analysis from investigators suggested the notes’ wording and distribution could indicate movement across state lines, though no concrete evidence has confirmed relocation. Former FBI officials appearing on news programs have noted that Bitcoin, while often perceived as anonymous, leaves a traceable blockchain trail that federal agencies can follow with proper resources.

Complicating the investigation, an “imposter” ransom attempt was identified and addressed. A California man, Derrick Callella of Torrance (previously identified in some reports as Hawthorne), was arrested and charged federally after allegedly sending text messages to Guthrie family members demanding Bitcoin payment. The messages, sent via a VOIP number, included phrases like “Did you get the bitcoin [we’re] waiting on our end for the transaction.” Authorities traced the number to Callella through associated email and app data, determining he had no connection to the disappearance and was attempting to exploit the situation for personal gain. He was released on bond following his initial court appearance.

Family members have made repeated emotional appeals. In videos shared publicly, Savannah Guthrie and her siblings pleaded for direct contact and proof that their mother is alive. Savannah addressed potential captors, saying the family was prepared to communicate but required verification. Her brother, Camron Guthrie, issued a similar plea near the first ransom deadline, stating, “We want to hear from you.” The family has emphasized Nancy’s health needs and expressed hope amid the uncertainty.

The timeline remains critical. Guthrie was last seen around 9:50 p.m. on January 31 after an Uber drop-off. The rural, dimly lit location of her home has limited potential witnesses and surveillance. Blood evidence on the porch suggested possible injury during the abduction, though the extent remains undisclosed. Search efforts have included K-9 units, ground teams, aerial support, and neighborhood canvasses, but no significant leads have been announced beyond the ransom analysis.

FBI Special Agent in Charge Heith Janke has addressed the ransom notes directly in press conferences, confirming details like the floodlight reference and deadlines while declining to speculate on threats or next steps. Pima County Sheriff Chris Nanos has described the scene as disturbing from the start and urged the public to report any suspicious activity from late January. Officials have cautioned that not all communications may be legitimate, though they are treating credible ones seriously.

The case has drawn national attention due to Savannah Guthrie’s prominence in broadcast journalism. President Donald Trump referenced the investigation in recent comments, suggesting developments could emerge “soon,” though no specifics were provided. Cybersecurity experts have weighed in on the Bitcoin demand, noting it is “unusual” given the currency’s traceability compared to cash, potentially aiding investigators if transactions occur.

As the February 9 deadline approaches, tension remains high. No follow-up communication has been reported after the initial notes, and the missed first deadline passed without apparent incident or confirmation of status. Authorities continue to appeal for tips via the FBI line, stressing any information – no matter how small – could be vital.

The Guthrie family, investigators, and a concerned public await resolution in what has become one of the most closely watched missing persons cases of the year. Whether the ransom notes lead to a breakthrough, prove to be opportunistic hoaxes, or signal a more complex scenario, the focus remains on locating Nancy Guthrie safely and bringing those responsible to justice