First ransom note in Nancy Guthrie kidnapping revealed in full, demanding Bitcoin and threatening death

 July 24, 2026

The full text of the first ransom note sent to the family of 84-year-old Nancy Guthrie after her abduction from her Tucson home has been publicly disclosed for the first time, months into an investigation that has produced no arrests and no suspects.

Arizona journalist Briana Whitney read the note aloud on an episode of the Crime Junkie podcast, marking the first time the public has heard the complete demands made to the family of the missing mother of NBC's Savannah Guthrie. The note, addressed directly to Savannah Guthrie by name, opened with a blunt declaration: "Hello, Savannah. We have your mother, Nancy."

Nancy Guthrie vanished from her $1 million home in Tucson, Arizona, in the early hours of February 1. The investigation, now described as months long, has yielded zero arrests and zero named suspects. The FBI and the Pima County Sheriff's Office have remained tight-lipped throughout. And the family, left to plead publicly for their mother's return, has been forced to endure a drawn-out ordeal with no resolution in sight.

A note that named a price, set a deadline, and promised death

The ransom note, as Whitney read it on the podcast, laid out terms with cold specificity. After confirming the abductors had Nancy Guthrie, the note stated she was "safe but scared" and would "be held for ransom." It promised her release "unharmed" once payment was received.

The note demanded millions of dollars in Bitcoin, directing payment to a specified cryptocurrency address. It set a maximum holding period of seven days and promised Nancy would be returned "within 12 hours of deposit to a safe drop-off location back in Tucson."

Then came the threat. The Daily Mail reported the note's exact language: "If the payment is not received by the last deadline on Monday the 9th at 5pm, she will be killed. Your mother is aware of this and her life is in your hands."

The note closed by cutting off any hope of negotiation. "It is in the best interest of everyone to have this completed as soon as possible," it read. "You will not be able to contact me from here on out. There will be no negotiation. Do not play games. Law enforcement will not be able to help you."

For a family already reeling from a loved one's disappearance, those words amounted to a stark ultimatum with an 84-year-old woman's life hanging on a cryptocurrency transfer.

Non-public details convinced the FBI this was no hoax, at first

Whitney explained on the podcast that the note contained details only someone with direct knowledge of Nancy Guthrie's home would have known. Two specifics stood out: a white smartwatch found on the floor near the foot of Nancy's bed, and a floodlight that had been destroyed in her backyard.

Whitney described how those details shaped the FBI's initial assessment. "Those two clues are what gave the FBI kind of the wherewithal to say this is not a hoax," she said on the podcast. At the time, investigators treated the note as a potentially legitimate communication from whoever took Nancy Guthrie.

Federal agents took a concrete step to test the note's authenticity. They deposited $152 into the cryptocurrency address specified in the ransom demand. After that deposit, another ransom email arrived, sent from the same IP address as the first note.

That sequence, a small deposit followed by a second communication from the same digital origin, gave investigators a thread to pull. But months later, it has not led to an arrest or a named suspect.

The broader investigation has painted an increasingly grim picture. National Review reported that FBI-recovered doorbell camera footage showed a masked individual with a backpack and what appeared to be a holstered gun attempting to disable the camera at 1:47 a.m. on February 1, the night Nancy vanished. A retired bloodstain pattern analyst, Paulette Sutton, described blood found near the front doorstep as a "drip trail," meaning "a continuous source of blood dripping from an object or from a person."

Multiple ransom notes muddied the trail, and some were outright fakes

The first note was not the last. Several ransom notes surfaced in the weeks and months after Nancy Guthrie's disappearance, sent to family members, media outlets, and law enforcement. TMZ announced three days after Nancy's disappearance that it had received a ransom note demanding $4 million in Bitcoin for her return.

Ransom demands sent to local media outlets climbed as high as $6 million in Bitcoin, with deadlines of February 5 and February 9, both of which passed without payment. A subsequent note, AP News reported, claimed Nancy Guthrie had died unintentionally shortly after the kidnapping. Authorities initially withheld that note's contents to preserve the integrity of potential future communications.

Sorting legitimate communications from opportunistic fraud became a central challenge. The New York Post reported that the FBI clarified some ransom notes were "extortion attempts without legitimacy," while others remained under active investigation, particularly those that correctly identified non-public details like the broken security light and the Apple Watch Nancy had been wearing.

A cyber crime specialist, attorney Todd Spodek, offered a blunt assessment of the ransom scheme's sophistication. He told the Post:

"An actual, sophisticated operation wouldn't have gotten involved in a kidnapping conspiracy-turned-homicide. That alone says it's rookie s***."

FBI Director Kash Patel, when pressed on the case, declined to elaborate. "I'm not going to comment on that," Patel said. "We are continuing to assist that investigation. We've always been in an assist role. It's a state matter being led by the state authorities."

That distinction, the FBI in an "assist role" while state authorities lead, has done little to reassure a family now five months into an agonizing wait. A judge recently sent one ransom hoaxer to inpatient treatment, underscoring how the case has attracted not just investigators but also fraudsters willing to exploit a family's desperation.

Breitbart reported that a senior FBI official stated flatly: "None of the ransom notes are believed to be genuine." That determination cast doubt on the fundamental premise that Nancy Guthrie was abducted for ransom at all, a premise that had driven the investigation's early direction.

If the ransom notes were all fraudulent, the question shifts from who demanded the money to what actually happened to an 84-year-old woman in the early hours of a February morning in Tucson.

Savannah Guthrie's public plea came one day after the FBI's test deposit

The day after federal agents deposited $152 into the cryptocurrency address, Savannah Guthrie posted a video to her Instagram page. She sat next to her brother, Camron, and her sister, Annie. The NBC host's message was direct and desperate.

"We beg you now to return our mother to us, so that we can celebrate with her," Savannah Guthrie said. "This is the only way we will have peace. This is very valuable to us, and we will pay."

The phrasing, "we will pay", carried obvious weight. A family with a public platform was signaling compliance with demands that investigators were still working to authenticate. Whether that plea reached anyone who actually held Nancy Guthrie remains unknown.

Savannah Guthrie's personal security concerns have extended beyond her mother's case. A security breach at the Today show added another layer of crisis for the NBC host during an already harrowing period.

Five months, no arrest, and a case full of contradictions

Nancy Guthrie was 84 years old when she disappeared. She required daily medication. Blood matching her DNA was found on her front porch. Doorbell camera footage captured a masked, armed figure at her door in the middle of the night. Ransom notes demanded millions in Bitcoin. A subsequent note claimed she was dead.

And yet: no arrests. No suspects named. An FBI that describes itself as playing an "assist role." State authorities leading an investigation that, five months in, has produced no public breakthrough. Reports of internal disagreement within the FBI over the interpretation of evidence have only deepened questions about the investigation's direction.

The full disclosure of the first ransom note adds detail but not clarity. Whitney's reporting on the Crime Junkie podcast confirmed what investigators initially found persuasive, the note's non-public details about the smartwatch and the destroyed floodlight. But the FBI's later determination that none of the ransom notes appear genuine raises a harder question: if the notes were all fakes, who wrote the first one with details only someone inside Nancy Guthrie's home would know?

The case now sits at five months with more questions than answers and a family left to wait.

An 84-year-old woman vanished from her home in the middle of the night. Her family begged publicly for her return. The people who were supposed to find her have gone quiet. That silence is not a strategy, it is a failure the Guthrie family lives with every day.

Most Recent Stories

Copyright 2026, Thin Line News LLC