Six months after 84-year-old Nancy Guthrie vanished from her Tucson-area home, a crypto forensics expert says the untouched bitcoin wallet tied to her ransom note could still lead investigators to whoever is responsible.
Guthrie was reported missing on February 1 from her home in the Tucson area of Arizona. In the weeks that followed, several alleged ransom notes surfaced, one demanding $6 million in bitcoin sent to a specific digital wallet address. Shortly after, roughly $152 worth of bitcoin appeared in the wallet's publicly viewable logs. Not a cent has moved since.
Authorities released security footage showing an armed and masked individual standing outside Guthrie's home on the night she disappeared. No suspect has been arrested. No body has been recovered. And her daughter, Savannah Guthrie, host of NBC's "Today" show, posted an Instagram video this week marking the grim milestone.
Savannah Guthrie did not hold back:
"I'm coming to today with a very specific message. It has been months since our mom was taken from us. Our family is in agony."
She added: "We are in a nightmare that will not end, nothing about our situation has changed."
The fact that the bitcoin wallet has gone dormant might look like a dead end. Bezalel Eithan Raviv, CEO and founder of Lionsgate Network, a crypto recovery service specializing in blockchain forensics, told Page Six that it is anything but.
"An unused wallet can still be valuable. Investigators examine whether the address has any relationship to other known wallets, whether it appears in previous criminal investigations, darknet activity, scam infrastructure, or blockchain clustering databases."
Raviv, who also works as a financial fraud investigator, explained that blockchain data is permanent. Unlike phone records or surveillance footage stored on third-party servers, bitcoin transactions do not expire. That permanence gives investigators a widening window, not a closing one.
"This illustrates one of the biggest strengths of blockchain intelligence. The value often lies in the relationships between wallets, infrastructure, and actors, not simply in the movement of funds."
In plain terms: even a wallet nobody touches can be cross-referenced against databases of known criminal wallets, sanctioned addresses, and exchange records that cooperate with law enforcement. The longer those databases grow, the more likely a match becomes.
One of the more striking threads in Raviv's analysis is the possibility that the $6 million bitcoin demand was never meant to be paid at all. A wallet generated for a single communication, left unused, fits a pattern investigators have seen before.
"A wallet that remains completely unused may indicate that it was generated solely for a single communication, that the sender anticipated payment through another mechanism, or that the demand itself was never intended to reach the payment stage."
Raviv went further, noting that criminals sometimes introduce cryptocurrency into high-profile cases specifically because it "immediately attracts public attention and creates the perception of technical sophistication." In some investigations, he said, ransom communications are genuine. In others, they "may serve to misdirect investigators, exploit media attention, or complicate the investigative timeline."
That distinction matters. If the ransom note was a distraction, the real motive for Guthrie's disappearance may lie somewhere else entirely, and investigators chasing bitcoin leads would be looking in the wrong direction.
Raviv emphasized that a cryptocurrency wallet is only one piece of a much larger puzzle. Modern digital investigations pull from every layer of the communication chain.
"Digital investigations extend far beyond blockchain transactions. Investigators analyze how the address was generated, the devices or services used to create it, whether it appears elsewhere online, associated metadata, communication channels, linguistic characteristics, timestamps, and operational security mistakes made by whoever distributed it."
The wording of the ransom note, the method used to deliver it, the timing of the demand relative to Guthrie's disappearance, all of it feeds into what Raviv described as "attribution intelligence." And he stressed that the absence of wallet activity is itself a data point, "although it should never be interpreted in isolation."
Put differently: investigators are not just watching for money to move. They are mapping the infrastructure around the wallet, who created it, how, and whether any operational mistakes left fingerprints.
Kidnapping survivor Elizabeth Smart weighed in on the case at the 25-week mark, drawing on her own experience, she was rescued nine months after her abduction. Smart told Fox News there is still reason to believe Guthrie could be alive.
"I want to remind people that there isn't a body, so there is still reason to have hope that she is alive and that we shouldn't give up until we find her."
Smart urged anyone with information, "the smallest detail that might seem insignificant", to report it to authorities. A purported follow-up message claiming Guthrie had died has not been confirmed as authentic by investigators. The combined reward from authorities, the 88-CRIME tip line, and the Guthrie family now totals more than $1.2 million.
Six months is a long time for a family waiting for answers. Raviv acknowledged that delay carries risks. Some evidence becomes harder to obtain as digital records expire or service providers change their retention policies.
But he argued that time also works in investigators' favor.
"Exchanges cooperate with law enforcement, new sanctions are issued, additional criminal infrastructure is identified, and intelligence databases expand over time."
A wallet that looks like a dead end today could light up months from now if the person behind it makes a single mistake, moves funds, reuses an address, or connects to infrastructure that gets flagged in an unrelated case.
"A wallet that appears dormant today may become operational months later, creating new intelligence opportunities and potentially revealing connections that were previously impossible to establish."
Raviv summed up the investigative philosophy in six words: "In digital investigations, what did not happen can sometimes be just as significant as what did."
An 84-year-old woman is missing. Her family is in agony. Over $1.2 million in reward money sits unclaimed. And somewhere on the blockchain, $152 in bitcoin waits, untouched, unexplained, and, if the experts are right, far from useless. The least the rest of us can do is keep paying attention.
