Bitcoin Transfer, New Ransom Demand Surface in Nancy Guthrie Abduction Case: Reports

In brief

• A Bitcoin wallet cited in earlier ransom notes recorded a small new transfer, TMZ reported.
• A new message sent to the outlet demanded 1 Bitcoin for information tied to the case.
• Authorities released footage of a suspect Tuesday, then detained and released a person of interest.

A Bitcoin wallet address cited in ransom notes tied to the high-profile disappearance of Nancy Guthrie recorded new activity this week, with a fresh demand for a Bitcoin ransom surfacing on Wednesday. Guthrie, the 84-year-old mother of NBC’s “Today” co-host Savannah Guthrie, vanished from her Tucson, Arizona, home on January 31. Since then, multiple ransom notes have been sent to media outlets demanding payment in Bitcoin in exchange for information about her whereabouts. On Tuesday, TMZ reported that a small transaction worth less than a few hundred dollars was sent to the Bitcoin wallet address referenced in one of the notes. Authorities have not confirmed who initiated the transfer, whether they believe it was a test transaction, or whether it is connected to the disappearance. 

According to TMZ, a third letter was sent on Wednesday, demanding 1 Bitcoin—currently worth about $67,500, based on CoinGecko data—in exchange for the identities of those responsible. Surveillance footage released by authorities Tuesday shows a masked individual tampering with Guthrie’s front-door Google Nest camera. “Working with our partners, as of this morning, law enforcement has uncovered these previously inaccessible new images showing an armed individual appearing to have tampered with the camera at Nancy Guthrie’s front door the morning of her disappearance,” FBI Director Kash Patel wrote on X.

UPDATE: New images in the search for Nancy Guthrie - pic.twitter.com/dXcSBVxkDC

— Pima County Sheriff’s Department (@PimaSheriff) February 10, 2026

The Bitcoin address has not been released publicly, making outside verification nearly impossible at this point. Still, investigators say possession of the wallet address gives law enforcement a starting point for identifying the suspects. “When there’s a cryptocurrency address in an investigation, it provides a really powerful tool for law enforcement because they can track and trace the flow of funds in real time,” Ari Redbord, global head of policy at TRM Labs and a former federal prosecutor, told_ Decrypt_. “But it is not a silver bullet,” he added. “You need to marry blockchain intelligence and crypto tracing with other law enforcement tools. The key is to watch for when that address transacts with a cryptocurrency exchange,” Redbord said. “The actor will need to cash out those funds, and when they try to do that, the hope is the exchange has conducted know-your-customer checks and can assist law enforcement.” While no arrests directly tied to Guthrie’s disappearance have been announced, on Tuesday, a man who identified himself as Carlos Palazuelos was detained for questioning but later released without charge. Earlier this month, the U.S. Department of Justice charged Derrick Callella of Hawthorne, California, with demanding Bitcoin via text from the Guthrie family. Prosecutors said Callella admitted to sending two text messages using a VOIP account after obtaining the family’s contact information from a website. Authorities have not linked those messages to the original ransom demand. The investigation remains ongoing. Savannah Guthrie said in a social media message over the weekend and she and her siblings were willing to pay a ransom for the safe return of their mother.