Investigators are examining ransom letters tied to the disappearance of 84-year-old Nancy Guthrie, the mother of “Today” co-host Savannah Guthrie, after messages demanding cryptocurrency were sent to media outlets and claimed she is “safe but scared,” officials and media executives said.
The case has drawn national attention because the communications did not go directly to relatives, a route experts say is unusual in kidnappings for ransom. Authorities have not confirmed that the sender controls Guthrie’s whereabouts, and they have not announced a suspect. The Pima County Sheriff’s Department is coordinating the investigation with the FBI, while detectives work to verify where the letters came from and whether any details inside show access to Guthrie or her home.
Guthrie was reported missing after relatives could not reach her late last weekend, officials said. Deputies conducted welfare checks and began canvassing a neighborhood in the Tucson area as the inquiry shifted from a missing person report to a criminal investigation. By early week, at least one letter had been delivered to a national outlet outlining a demand for a multimillion-dollar payment in bitcoin and setting a deadline, authorities said. A later message surfaced at a local Arizona television station and was forwarded to investigators for analysis. Family members, including Savannah Guthrie, made emotional appeals for direct contact and for proof that Nancy Guthrie is alive, as the first deadline passed without any publicly confirmed follow-up.
Law enforcement officials said they are treating the letters as potential evidence, but not as proof of life on their own. Investigators are tracing how and from where the communications were sent, including whether internet services were used to mask locations and whether the messages traveled through different technical routes. Detectives also asked nearby residents for doorbell camera video and other home security footage covering the hours around Guthrie’s last confirmed contact. “We are following every credible lead,” a department spokesperson said in a statement relayed by local officials, adding that tips and materials are being shared with federal partners.
TMZ founder Harvey Levin said his newsroom received a letter that he described as structured and directive, with instructions and timelines. Levin said the message asserted that Guthrie was alive, frightened and being held by abductors, and that she was aware of the demand being made for her return. Authorities declined to release the full text of any letters, citing the ongoing investigation, and they cautioned that they are still determining whether the writer is connected to Guthrie’s disappearance or is attempting to exploit the case. Officials acknowledged that a second communication delivered to an Arizona outlet appeared to originate differently from the first, a point detectives are evaluating as they compare wording, timing and any technical markers that might link the messages.
Investigators returned to Guthrie’s neighborhood during the week to re-canvass the area and reprocess her home, according to people briefed on the activity. Deputies documented the exterior and focused on the porch and doorway, while specialists continued laboratory testing on physical traces collected earlier, officials said. Authorities have not described the specific items recovered, saying the details could compromise the search. Neighbors described a steady law enforcement presence, with patrol cars idling near intersections and plainclothes detectives going door to door asking about visitors, overnight deliveries and unfamiliar vehicles.
Family members have said Nancy Guthrie has health conditions that require daily medication, a factor investigators consider when assessing risk and timelines. Officials have not said whether medication was found inside the house or whether a missing prescription might help narrow the time frame of the disappearance. They also have not disclosed the exact time of her last verified phone call, message or in-person sighting. Investigators are reviewing available surveillance footage and digital records to build a minute-by-minute account, a process that can take days as detectives obtain, download and synchronize videos from private systems.
Experts familiar with kidnap investigations say communications sent to newsrooms can signal a desire for attention, an attempt to pressure the family through public fear or an effort to appear credible without opening direct negotiations. In traditional ransom cases, abductors typically contact relatives to keep leverage and control the flow of information, said one former federal agent interviewed on national television. The heavy publicity surrounding the Guthrie case could also complicate decision-making for both investigators and the family, experts said, because it increases the chance of hoaxes and copycat messages while also prompting intense scrutiny of every statement and timeline.
Authorities said verifying the letters involves several tracks that run in parallel. Digital specialists examine routing data, device signatures and metadata where available, while analysts compare the language of each message to identify repeated phrasing or patterns. Investigators also review any cryptocurrency addresses listed in the letters to determine whether they are newly created, whether they have been used before and whether any funds move through them. Officials declined to say whether they have seen activity tied to the addresses or whether they consider any to be decoys. Agents also look for nonpublic details, such as references to clothing, objects or the layout of a home, that could indicate the writer has direct knowledge of the victim’s circumstances.
The Pima County Sheriff’s Department and the FBI have not said whether the letters contained such private markers. Officials said they are weighing what can be safely made public without tipping off the sender or narrowing investigative options. In many cases, law enforcement withholds specific details to protect negotiations, preserve the integrity of future warrants and avoid alerting a suspect that authorities have identified a technical trail. Prosecutors often coordinate early with investigators in cases involving extortion demands, officials said, because potential charges can include kidnapping, extortion and wire fraud, depending on the evidence and the method of communication.
Public attention intensified as Savannah Guthrie and other family members asked for proof of life and pleaded for direct contact. Colleagues at NBC and others in broadcasting also spoke publicly about the family’s distress. President Donald Trump, in separate public remarks this week, said federal authorities had developed strong clues and suggested investigators might provide an update after comparing digital evidence and field reports. Law enforcement leaders in Arizona did not announce a scheduled briefing, but they said verified information would be shared as soon as it could be released without jeopardizing the search.
In Guthrie’s neighborhood, residents said patrols increased along nearby streets and that deputies asked businesses to watch for unusual activity, including attempts to sell or swap electronics. Investigators sometimes seek such information because devices can hold location data, call logs or other records that help establish timelines. A mobile command post was staged nearby during portions of the week as detectives cross-checked tips arriving by phone and online, neighbors said. Several residents described a quiet block with light daytime foot traffic, making any late-night movement stand out, though officials have not said whether any witness accounts have been corroborated.
As of Saturday, authorities said they had not confirmed Guthrie’s location and had not publicly identified any person of interest. Investigators said any additional messages connected to the case would be routed immediately to the FBI for evaluation, and they urged caution about circulating unverified claims. Detectives planned to maintain increased patrols through the weekend while lab results and digital analyses continue, officials said, and the family said it is cooperating while requesting privacy.
Author note: Last updated February 7, 2026.