Nancy Guthrie Bitcoin Account Moves $152 — Raises Alarm in Ongoing Ransom Investigation
FBI and Pima County Sheriff's Office closely monitoring the Bitcoin account

The Bitcoin account linked to Today show co-anchor Savannah Guthrie's missing mother has indicated its first recorded activity since the $6 million (£4.4 million) ransom demand, following the high-profile kidnapping of Nancy Guthrie, authorities confirmed. According to reports, the $152 (£111) transferred from the account's wallet drew attention to the investigation.
Savannah Guthrie's 84-year-old mother, Nancy, drew national attention when she went missing on 31 January 2026. She disappeared from her Tucson, Arizona home in the middle of the night. Within just two days of her disappearance, media outlets such as KOLD and TMZ were sent ransom letters by the perpetrators, demanding a ransom of $6 million (£4.4 million).
The FBI and the Pima County Sheriff's Office have since been closely monitoring the Bitcoin account linked to Nancy Guthrie, with public logs showing the transfer. The movement could likely indicate the perpetrator/s could be testing the account or even moving funds, according to a report by Live Mint.
Breaking: Harvey Levin tells OutFront he just saw “activity” in the bitcoin account from the first Guthrie ransom note sent to TMZ. pic.twitter.com/eVvfzNku8v
— Erin Burnett OutFront (@OutFrontCNN) February 11, 2026
The Nancy Guthrie Case Investigation
Investigation on Nancy Guthrie's disappearance began swiftly following her disappearance. When she failed to check in with family, the local authorities, along with federal agencies FBI and Pima County Sheriff's Office, launched a coordinated search for Savannah Guthrie's mother.
The investigation focused on analysing surveillance footage, one of which revealed a masked suspect in close vicinity to the Guthrie residence. FBI Director Kash Patel revealed on Tuesday the images of the masked suspect with a visible handgun holster outside Nancy Guthrie's front door on the night of her disappearance. The masked suspect was also wearing a backpack and a ski mask.
In the security footage, the masked suspect is seen with a flashlight in his mouth, while his hand attempts to cover the camera using a plant. Although the image of the masked person provided the public with an initial look at the potential perpetrators to Guthrie's kidnapping, it did not include further details on what happened that night.
Ransom letters demanding $4 million (£3 million) in Bitcoin in exchange for her freedom were sent out, which was later changed to $6 million (£4.4 million) in Bitcoin. The investigation received further public interest as the missing 84-year-old, who reportedly has health concerns and needs medications daily, is the mother of Today co-host Savannah Guthrie.
Anybody know this guy? This is the suspect in the Guthrie kidnapping that just popped up on the local NBC station. You can get this doorbell video online but this is the best frame. Good shot of his eyes and that is a big help for the fbi I bet. Any law enforcement on here know? pic.twitter.com/OCK0nNfLbB
— America First (@sgvette707) February 10, 2026
The $6 million (£4.4 million) in Bitcoin ransom deadline was at 5:00 p.m. on 9 February, according to sources. Savannah Guthrie released a video that falls during 'an hour of desperation,' asking the public for help. Savannah Guthrie emphasised that her mother required regular high blood pressure medication, and that she has a pacemaker.
US President Donald Trump has weighed in on the high-profile case, saying it was a 'terrible thing,' and said the case could be provided federal assistance.
Cryptocurrency Account
Authorities are pursuing the examination of the surveillance footage where a masked suspect was sighted. The footage has since been released to the public. Officials are also said to be coordinating with cybersecurity specialists to monitor the movement of funds in the cryptocurrency account.
According to the FBI, the smallest of movements in the Bitcoin account are immediately addressed. Sources revealed that the recent transfer into the Bitcoin account is not indicative of a partial payment to the ransom. Instead, it sparks concerns over the account's handling.
© Copyright IBTimes 2025. All rights reserved.





















