AZ Nancy Guthrie, 84, (mother of TODAY Show host Savannah Guthrie) missing - last seen in the Catalina foothills area on Jan 31, 2026

[arielilane]

4:34 PM PT -- We've seen activity for the first time in the bitcoin account listed in the first ransom note which was sent to us here at TMZ, and also to 2 TV stations in Tucson. For various reasons, we are not going to reveal the amount, but the activity happened in the last 25 minutes.

Potentially big development in the Nancy Guthrie abduction ... our law enforcement sources say whoever kidnapped her from her Arizona home is also from the Tucson area.

Multiple sources involved in the investigation tell TMZ ... the operating theory is that the ransom notes were written by the kidnapper, and those notes provide clues on where the abductor lives.

Nancy Guthrie Kidnapper Likely From Tucson Area, First Activity in Bitcoin Account

Why is TMZ reporting this info?

 

[sds71]

NEW INFO: KGUN 9 can confirm there is activity in the bitcoin account listed in the ransom email. The activity is less than $300

https://twitter.com/x/status/2021384301389234390

 

[avalonisland]

Could the gun and holster have been borrowed or given to perp for this crime? These images are frightening.

I think the gun and holster are simply to use if the guy who is concealing the crime that probably took place earlier 1/31/26 may need to protect himself not to commit crime and abduction of elderly woman. No reason on this planet to remove this older woman unless for money and if she was deceased

 

[su5ie]

I know alittle bit (but not much) about bitcoin, but can anyone please explain how HL would have the kind of access to see activity in the account? Would be able to see if it was a deposit or withdrawal?

He has the account number from the ransom note they recieved monday

 

[Wsimm]

Fox reporting less than $300 bucks in bitcoin wallet

 

[TheDinks]

Did they put money into bitcoin account and LE FBI are positioned or surveilling to be able to see computer activity from suspect.

imo they would have to... it's a lead... I've said it a few times this week.

 

[snoopy100]

With this Insta caption and activity in the Bitcoin - did they get proof of life?

View this content on Instagram

View this content on Instagram

i said yesterday when SG posted her video that it her demeanor seemed like they received proof of life. many doubted it, but this makes me even more convinced.

i've believed since the beginning the kidnapper and the person who sent the ransom note were the same or at least connected. this may not have been a perfectly executed plan, but it seems like it was well-planned. there's way too many resources being poured into this for it not to be legit IMO. they wouldn't waste all this manpower, time, and now, money, if they didn't have information to determine that it was seriously credible.

i hope more than anything nancy is found alive.

 

[Lore Listener]

Local news station KGUN who also has access to the ransom bitcoin account is reporting that the amount deposited is less than $300. Looking for link!

Edit: I see others have posted links. Literally an hour ago my mom said: be careful trusting TMZ! Haha.

 

[MassGuy]

https://twitter.com/x/status/2021384054638043462

 

[Cardgame]

4:34 PM PT -- We've seen activity for the first time in the bitcoin account listed in the first ransom note which was sent to us here at TMZ, and also to 2 TV stations in Tucson. For various reasons, we are not going to reveal the amount, but the activity happened in the last 25 minutes.

Potentially big development in the Nancy Guthrie abduction ... our law enforcement sources say whoever kidnapped her from her Arizona home is also from the Tucson area.

Multiple sources involved in the investigation tell TMZ ... the operating theory is that the ransom notes were written by the kidnapper, and those notes provide clues on where the abductor lives.

Nancy Guthrie Kidnapper Likely From Tucson Area, First Activity in Bitcoin Account

Maybe when they say the notes provide clues they mean they have finally cracked the location of the IP address?

 

[Puzzles8]

I know alittle bit (but not much) about bitcoin, but can anyone please explain how HL would have the kind of access to see activity in the account? Would be able to see if it was a deposit or withdrawal?

IMO, trying to explain Bitcoin in a sentence or two is like trying to explain nuclear physics.

Wiki has a pretty good explanation for the sake of discussion

Bitcoin - Wikipedia

en.wikipedia.org

JMO

ETA - Look under

Addresses and transactions​

 

[AZYaYa]

It would be pretty easy for the cops to bring the device to any suspected location of NG to see if it connects. JMO

I mean, if they think the person is from Tucson and holding her in Tucson, couldn't they even drive around with her phone or whatever collects the pacemaker information and try to get a ping? Especially if they have a narrow-ish radius? (I realize this may be a really dumb idea!)

 

[BenjaminJAndersonAlly]

Nancy Guthrie Kidnapper Likely From Tucson Area, First Activity in Bitcoin Account

Potentially big development in the Nancy Guthrie abduction ... our law enforcement sources say whoever kidnapped her from her Arizona home is also from the Tucson area.

www.tmz.com

Here is the link w/TMZ stating there was activity in the Bitcoin account associated with the ransom note(s).

Harvey Levin was also on CNN (Erin Burnett Upfront show) discussing this, this hour..

 

[knla]

Why so you think the person is at the front then, taking off the camera, if there was another open door to go through?

Retrieved surveillance just shows him disabling the doorbell cam. There was reported to be no signs of forced entry. And Nancy wouldn't have opened the door. Back door was left open. He may have took Nancy out through the front door, because of the blood trail, if she ever got home.

 

[elidar]

It’s a plant.

he grabs some kind of thread like a string of lights lower right edge of entry way pulls it into porch area to cover camera -they could be decorative flower shaped mini lights -anyhow not important but not flowers IMO

 

[Alkali13]

No one finds it strange that someone ordered pizza to Nancy's house? And the guy who delivered it looks identical to the footage? Same walk and everything? He also bypassed security and press to walk up to door? Obviously it's likely he's innocent, but it would be crazy to just overlook it.
Suspects always return to the scene, and most of them insert themselves into the investigation, some get interviewed and others will attend search parties.

the link of him walking:

View this content on Instagram

View this content on Instagram

I would put good money on some teenager thinking this was hilarious and doing it. The pizza guy is a victim of a prank IMO.

 

[raja]

If they have a suspect they may have put money into see if there is a connection between the suspect and the bitcoin account or in other words is the bitcoin demand just a random crime and not connected to the actual perp they are pursuing. Does that make any sense?

 

[aawaterloo]

https://twitter.com/x/status/2021299320218431733

New images from Nancy Guthrie’s porch the night she went missing. Anyone with information, please contact 1-800-CALL-FBI or visit http://tips.fbi.gov

https://twitter.com/x/status/2021298989849612680

More images:

View attachment 643490View attachment 643491

JMO, Just taking a swag on his/her height. If you look at the prep as he is standing by the front arch, and counting the bricks using images of NG front porch posted here, they seem to be 5-10 or 5-11. I used 3 inch for each brick and an inch for the mortar. I used the brick that can be seen protruding from the arch as reference as well.
JMO

 

[NoeticSoul]

Fox reporting less than $300 bucks in bitcoin wallet

Mabey they are waiting to see if the person's who's BTC wallet address a $300 'test amount' was deposited into, is stupid enough to move it to an exchange online, and try to cash it out to a bank! LOL that'd be sweet. moo

 

[SlimPickens]

NEW INFO: KGUN 9 can confirm there is activity in the bitcoin account listed in the ransom email. The activity is less than $300

https://twitter.com/x/status/2021384301389234390

6 million pesos?