- 3 days ago
Claims that a person has died can spread with extraordinary speed, especially when they are phrased in shocking, emotionally charged language such as “ransom note” or “death note.”
When a headline or message says “Nancy Guthrie is dead,” readers often feel immediate concern, confusion, or fear before any facts are confirmed.
That reaction is understandable, because reports of death are among the most sensitive and consequential claims in public communication.
At the same time, the phrase “ransom note claims” raises the possibility of misinformation, fabrication, manipulation, or an unverified hoax.
When a headline or message says “Nancy Guthrie is dead,” readers often feel immediate concern, confusion, or fear before any facts are confirmed.
That reaction is understandable, because reports of death are among the most sensitive and consequential claims in public communication.
At the same time, the phrase “ransom note claims” raises the possibility of misinformation, fabrication, manipulation, or an unverified hoax.
Category
🛠️
LifestyleTranscript
00:00Text of two ransom notes has now been released. It's now been six months
00:04since the disappearance of the mother of Today Show anchor Savannah Guthrie.
00:08Our Alex Stone is following the story. A grandmother vanishes from her Tucson home
00:12in the dead of night. Days later, a ransom note demands millions. Then another message arrives
00:17claiming she's already dead, buried somewhere in the Arizona desert. And just when the police
00:21thought they had an important lead in the case, yet another bombshell was revealed.
00:24The Ransom Notes, Demands and Proof The first ransom note arrived February 2,
00:30addressed to Savannah Guthrie specifically. The opening was chilling and direct. This was no
00:34anonymous threat. Someone knew who Savannah was. Someone knew she had money. The demands were
00:38precise and escalating. $4 million in Bitcoin by 5 p.m. Thursday, February 5, just three days away.
00:44If that deadline passed, the amount would jump to $6 million due by 5 p.m. Monday, February 9.
00:50The threat was explicit and immediate. Most significantly, the note included
00:53authenticating details only an abductor would know. A white smartwatch positioned on the floor at the
00:58foot of her bed and a destroyed white floodlight in the backyard. These specifics were intended to
01:02prove the kidnappers had been inside Nancy's home. To the FBI and Sheriff's Department, they suggested
01:08the notes might be genuine. Then on February 6, before the first deadline had even passed,
01:12a second note arrived. The tone shifted dramatically. The address changed from Hello Savannah to Guthrie
01:18family. The substance changed entirely. The note read that they never intended to hurt her,
01:22but that she had perished shortly after she was taken from heart-related causes and was now buried
01:27in nature. The specificity of this claim was troubling to those who analyzed it. The note
01:31referenced her physical condition, something only someone in direct contact with Nancy would know.
01:36It attributed the death to heart-related causes, which aligned with publicly available information
01:40about her health, but also suggested the writer knew more than they should. If this was a lie,
01:44it was a remarkably informed one. If it was true, it meant Nancy had died in captivity,
01:49and her body was somewhere in the Arizona desert. The contradiction was jarring. The first note
01:53promised Nancy would be released unharmed. The second claimed she was dead. If Nancy had already
01:58died, why send the initial ransom demand? Why establish deadlines and threat execution for
02:03someone who was already gone? The linguistic patterns were unusual and revealing. The writer
02:07employed formal business language mixed with colloquial phrasing, money in the amount of, payment that
02:12will need to be paid by, wanting to have this completed. These constructions sounded like they came
02:16from someone for whom English was not a first language, or possibly someone using a translator
02:21or even AI tool to draft communications. One detail stood out starkly. The demand was specified
02:26in USD, meaning US dollars. A native English speaker writing to an American family would typically just
02:31say, dollars. The specification of USD suggested someone unfamiliar with American conventions, or
02:37someone accustomed to distinguishing between currencies, someone likely not based in the United States.
02:42FBI analyst Jason Pack analyzed the writing and observed. He writes like someone who spends his
02:47day sending business email, office language, and it sits strangely against the threats, which sound like
02:51they came off a television screen. If you knew this man, that is the part you would recognize,
02:56not his vocabulary, his habits. The word perished also stood out. It's slightly old-fashioned, formal,
03:01the kind of word someone might choose when attempting to sound more educated or technical. Combined with the
03:06euphemistic phrase, buried in nature now. It created a jarring mix of formality and directness.
03:11In late July, six months after Nancy's disappearance, the Pima County Sheriff's Department
03:15made a strategic decision. Release both notes publicly in full. The notes contained distinctive
03:20patterns of word choice, syntax, and phraseology that might be recognizable to someone who knew the
03:25writer. A friend, family member, co-worker, classmate, or acquaintance may recognize these patterns
03:30of expression and possess information that could help identify the individual responsible. Sheriff
03:35Chris Nanos issued an explicit appeal. All the investigators agree. There is somebody out there
03:40that knows something. They know who did this. We want to hear from those who know who did this.
03:44It could be a family member. It could be a brother, a sister, a friend, a neighbor. The public release
03:49was an implicit admission. After six months, investigators had developed no significant leads,
03:54identified no suspects. They were turning to the public in hopes that someone would recognize a
03:58writing style or voice pattern. Yet doubt about authenticity persisted. Reuters published a report
04:03citing an anonymous FBI source claiming none of the ransom notes were believed to be genuine. Yet
04:08the sheriff's department's decision to release them for public linguistic analysis suggested authorities
04:13still saw investigative value in them, whether as authentic communications or as products of someone
04:18with knowledge of the crime. Before going into more details, let's talk about what happened that night.
04:23The Disappearance and the Scene On January 31, 2026, Nancy Guthrie was dropped at her Catalina
04:30Foothills home around 9, 48 p.m. after spending the evening at her daughter Annie's house. She'd played
04:35games and had dinner with family. Her son-in-law, Tomas Ocheny, watched the garage close as he drove away.
04:40That was the last family sighting. The Catalina Foothills are sprawling desert terrain north of Tucson with older
04:46homes set far back on large lots, surrounded by desert brush and saguaro cacti. No streetlights illuminate the
04:51neighborhoods. Security cameras mounted on homes often can't see the street due to distance and
04:56darkness. This geography, vast, empty, unlit, made abduction feasible. Someone could operate here
05:01without immediate detection. On the morning of February 1, Nancy didn't appear at a friend's home
05:05to watch a church service via video call. Her family became concerned and went to check on her.
05:10What they found was evidence of forced entry and struggle. Blood droplets on the front porch. Her
05:14medications and phone left inside. Her Nest doorbell camera disconnected. Digital forensics revealed the
05:20timeline. At 1.47 am, the doorbell camera was disabled. At 2.12 am, security tampering was
05:26detected. At 2.28 am, her pacemaker lost connection with her monitoring app, indicating she'd been
05:31moved beyond its range, away from home. The Pima County Sheriff released the scene to the media within
05:36days, a decision Sheriff Chris Nanos later publicly acknowledged as a mistake. With media and
05:41investigators trampling the driveway, potential physical evidence was contaminated. The investigation was
05:46only days old. Nancy was still missing, yet the scene was no longer secure. But the doorbell camera
05:51itself was gone, whether taken as evidence or by the abductor remained unclear. However,
05:56residual data on the device survived. The FBI recovered video captured in the early morning hours,
06:01showing a masked figure in ski mask and gloves, carrying a backpack and displaying what appeared
06:05to be a holstered handgun. The person walked directly into frame with brazen, almost careless
06:10confidence. Later analysis suggested multiple visits to the property, indicating surveillance and
06:15planning before the abduction. Nancy Guthrie, 84 years old, frail, with a cardiac monitoring device,
06:21dependent on daily medications, had been taken against her will. Someone had studied this property.
06:26Someone had planned this carefully. What made Nancy particularly vulnerable became clearer as
06:31details emerged. She required daily medications that she'd left behind. Her heart was already compromised.
06:36Medical records showed she had significant health conditions that, if left untreated and if she was
06:40stressed, frightened, moved beyond her safe environment, could deteriorate rapidly. She was the type of
06:45person who could suffer catastrophic health failure within hours of such trauma. The reason
06:49why remained a mystery. The death claim and the investigation's response. When the second note
06:55arrived claiming Nancy's death, the Guthrie family faced an agonizing psychological dilemma. Should they
07:00treat the message as truthful? Was it a manipulation designed to pressure them into immediate payment?
07:05Should they respond, and if so, how? They had already been making public pleas. Savannah had appeared on
07:10camera, posted on social media, and begged for her mother's return. When the second note arrived,
07:14she released a carefully measured statement. We received your message, and we understand.
07:18She did not elaborate on the contents, did not confirm or deny the death claim. But the subtext
07:23was clear. The family was attempting to maintain dialogue with whoever held their mother. Savannah
07:27made emotional video pleas, asking the kidnapper to do the right thing now, and help them find Nancy.
07:33The family requested proof of life, evidence that Nancy was still alive. This is standard protocol
07:38in ransom cases. Without proof, payment seemed pointless. Without confirmation that Nancy could still
07:43be recovered, any bitcoin sent to the wallet was simply money sent into the void. Proof of life
07:48never arrived. What came instead was a small amount of bitcoin deposited into the ransom wallet by
07:53parties unknown, likely authorities and the Guthrie family working in coordination. A message was
07:58attached, contact us, we are ready to talk. The bitcoin wallet monitored carefully by investigators
08:03remained otherwise dormant. No additional communication emerged. No response to the test deposit was received.
08:08The presumed kidnappers did not take the bait. Investigators were left with a perplexing
08:13question. If Nancy was truly dead, why not respond to the communication attempt? If the kidnappers were
08:18simply lying, attempting to extort money based on a false death claim to pressure payment, wouldn't
08:22they have negotiated further? Or had they, as the second note suggested, simply abandoned the entire
08:27operation, cut ties, fled, decided the plan was no longer workable? But there was another possibility
08:32that haunted the investigation. What if the death claim was true? What if Nancy Guthrie,
08:3684 years old, medically fragile, had been taken from her home, moved away from her
08:40medications and monitoring devices, and her heart had simply failed? What if the kidnappers had
08:44underestimated her physical vulnerability? In that scenario, they faced an impossible situation.
08:49The ransom plan had catastrophically failed before it could begin. The proof of life the
08:53family demanded couldn't be provided. Nancy was gone, and so was any hope of collecting payment.
08:58All that remained was damage control, a confession of sorts, wrapped in language that suggested regret.
09:04Tips arrived claiming to know where Nancy was buried. An anonymous tip to a Mexican volunteer
09:08search group in June 2026 claimed Nancy was buried near a stream close to Nogales, Mexico,
09:14just across the border from Arizona. Investigators conducted searches at the suggested locations,
09:18they found nothing. The tip led nowhere. Weeks of investigative effort produced no body,
09:23no remains, no evidence. Emails continued arriving at TMZ and other media outlets claiming to possess
09:29information. One sender claimed to have video of Nancy alive on what they claimed was her last day
09:34with the kidnapper. For Bitcoin, this person would reveal the location. Authorities never confirmed
09:39the claim had any merit. Nothing materialized from it. The FBI had arrested someone early in
09:43the investigation for sending a fake ransom note to local media. That person later pleaded guilty.
09:49This demonstrated that authorities could distinguish between authentic and inauthentic
09:53communications relatively quickly, yet they never publicly declared the two primary notes
09:57definitively fake. Their official position remained cautiously ambiguous. Some communications in the case had
10:02been deemed bogus, but some were still under investigation as potentially legitimate. They
10:06neither confirmed nor denied the authenticity of the primary notes or the death claim. This
10:10official silence fueled intense public speculation. Online forums erupted with theories. True crime
10:16content creators obsessively dissected every word of the notes. Social media filled with amateur
10:21investigators attempting to solve what law enforcement had not. Months passed without a body,
10:26without arrests, without resolution. As one reporter who covered the case stated,
10:30we still don't really know if the ransom notes are legit. Six months into the investigation,
10:35Nancy Guthrie's death remained unverified, a claim made in a note, a message received and
10:40released to the public, a question mark hanging over an entire family and a nation watching.
10:45The investigation unravels. Behind the scenes, the investigation was fracturing. The Pima County
10:50Sheriff's Department and the FBI, initially coordinating, began to operate at cross purposes. The
10:55Sheriff's Department took control of on-the-ground investigation, while the FBI handled digital
11:00forensics, ransom analysis and tracking. But this division of responsibility created blind spots.
11:05Information didn't flow seamlessly. Decisions made by one agency weren't fully communicated
11:10to the other. Sheriff Chris Nanos faced mounting criticism. Early in the investigation,
11:14during a television station's evening newscast preparation, he was texted by a reporter asking
11:19for clarification on DNA evidence. The text came at 9.50 pm, roughly 10 minutes before the 10 pm news.
11:25His response was curt. Did you happen to notice the time? Give it a rest. This single text message
11:30became emblematic of a larger problem. Nancy had been missing for only a week. The nation was watching.
11:35Savannah Guthrie, the family, authorities, nobody was resting. Yet the sheriff seemed annoyed at being
11:40asked to clarify facts about a major investigation during normal news hours. The public noticed.
11:45Online criticism mounted. The media frenzy intensified as theories proliferated. True crime
11:50podcasters and YouTube channels obsessively analyzed every detail. Some suggested the notes themselves
11:55were hoaxes designed to confuse investigators. Others claimed Nancy was alive, possibly in Mexico.
12:01Amateur sleuths on Reddit and Facebook conducted their own investigations, sometimes zeroing in on
12:06innocent people based on circumstantial evidence and speculation. Savannah Guthrie, the professional
12:11journalist, found herself on the other side of the camera, not reporting the news but living it. She took an
12:16absence from the Today Show. When she did appear on air, her emotional state was visible to millions.
12:20She appealed directly to whoever had her mother. She begged for information. She asked for proof of
12:25life. The world watched as a daughter's anguish played out in real time on national television.
12:30The family was in agony. Six months had passed. No answers. Nobody. No suspects. The second notes
12:35claim that Nancy was dead hung over everything, but without a body, without remains, without any physical
12:40evidence doubt remained. Was she dead or alive? Was the note authentic or a manipulation? The
12:45uncertainty became its own form of torture. The porch guy video and the forensic hunt. On February 10th,
12:51the FBI released video footage recovered from residual data stored on Nancy's nest doorbell camera. What
12:57viewers saw was shocking. Trucks have been the same for a very long time. We want to try something
13:01different. VA text. The video showed someone moving with uncomfortable directness across the porch. No
13:12creeping. No skulking. Just walking directly toward a camera he knew or suspected was there.
13:22The figure wore a ski mask, gloves, and carried a backpack. What appeared to be a holstered handgun was
13:28visible across the midsection in an unusual configuration. He touched or attempted to obscure
13:32the camera using nearby plants, possibly trying to disable it. The boldness of it, the directness,
13:37the apparent indifference to documentation, was what chilled investigators and those who analyzed
13:42the footage. Law enforcement noted something critical about identifying someone on video.
13:53Gait analysis, body shape, movement patterns are deeply personal, difficult to fake or conceal.
13:58The mask obscured the face but not necessarily the identity beneath it. If you knew this person,
14:03you would recognize them. But they wouldn't. Months passed with no identification of the
14:09individual despite the video being viewed by millions. Online sleuths analyzed every frame
14:14obsessively. The backpack model, the gate, the unusual holster configuration. Some suggested Luke
14:19Dolly, who lived near Nancy's home and was detained early in the investigation, resembled the figure.
14:23Dolly was questioned, detained briefly and released. He maintained his innocence throughout.
14:27Forensic work proceeded alongside the video analysis. The blood droplets on the porch belonged to Nancy.
14:32DNA samples were collected from the crime scene with careful methodology. But the results proved
14:37problematic. The DNA found inside Nancy's home was mixed, containing multiple DNA profiles.
14:43Nancy's DNA was present, naturally. But so was DNA from her daughter, her son-in-law, friends who visited,
14:48possibly neighbors. Separating this mixed DNA sample, isolating any unknown profile, and attempting to
14:54match it to suspects or DNA databases proved far more difficult than investigators had hoped.
14:59Genetic genealogy was attempted but moved slowly. And even when matches were made,
15:04populations underrepresented in commercial DN, a database's complicated identification.
15:09Investigators located and tested gloves. A black glove found approximately two miles from
15:14Nancy's home was tested. The DNA inside belonged to a nearby restaurant worker, unrelated to the case.
15:19Other gloves were found closer to Nancy's home, but the evidence recovery process had been chaotic.
15:24Investigators later admitted they had disposed of gloves on the ground themselves during the investigation.
15:29When asked to clarify which gloves constituted evidence and which they had disposed of,
15:33the situation became muddled. Sheriff Nanos acknowledged this was problematic,
15:37but the damage had been done. The investigative trail had been contaminated.
15:41The doorbell camera footage remained the clearest evidence of the crime itself.
15:45It showed beyond doubt that someone had entered the property and taken Nancy.
15:48It provided physical characteristics, gait analysis and equipment details.
15:52And yet, despite this video being viewed by millions online, despite amateur investigators
15:56and professional analysts examining every frame in obsessive detail, the identity of porch guy remained
16:02unknown. After six months, the most direct evidence of the crime, video documentation of it happening,
16:07had not produced the identification that investigators desperately needed.
16:11The Evolved Wrench Attacks Theory
16:14Six months into the investigation, with no body, no suspects, and no clear path forward,
16:19a retired law enforcement investigator named Lisa Miller proposed a theory that would align
16:24many of the puzzle pieces. An Evolved Wrench Attack
16:26A traditional wrench attack is a cybercrime methodology targeting digital assets,
16:30specifically cryptocurrency and bitcoin. Rather than attempting to hack or bypass encryption remotely,
16:36the attacker uses direct physical coercion against a person to extract digital wealth.
16:40It's brutal, direct, and increasingly common in an age where vast fortunes exist in encrypted
16:44wallets rather than bank safes or safes. But Nancy Guthrie possessed no significant bitcoin or
16:50cryptocurrency. She was an 84-year-old widow living on a modest fixed income. So why would criminals
16:55target her for digital assets she didn't possess? Miller's theory Nancy wasn't the primary target.
17:01She was leveraged, a means to access her daughter's wealth. Savannah Guthrie was a well-known NBC television
17:06personality with substantial income. She had financial resources that could be accessed relatively quickly.
17:12Most importantly, she had a powerful motive to pay her mother's life. The theory posited two
17:16perpetrators working in concert. First, the mastermind, someone overseas or foreign,
17:21sophisticated in digital affairs, understanding cryptocurrency, encrypted communications,
17:26and how to extort payment through untraceable means. This person would have designed the plan,
17:30established communication protocols, and coordinated the extortion from a distance.
17:35Second, the local actor, Porch Guy, the person hired to carry out the physical abduction.
17:39This individual would have been local to southern Arizona or possibly Mexico. He was selected and
17:44likely hired to do the actual work, surveilling the property, entering the home, taking Nancy,
17:49and holding her until ransom was paid. Remarkably, a cybersecurity firm independently confirmed the
17:54pattern aligned with known wrench attack methodology that had been evolving globally.
17:58The theory gained credibility. The theory explained several puzzle pieces. It explained why the ransom
18:03note was addressed specifically to Savannah. Because Savannah was the wealth target,
18:07the person with resources to extort. It explained the specificity of the demands and the requirement
18:11for Bitcoin payment. Because the mastermind needed untraceable payment. It explained the unusual
18:16linguistic patterns in the notes. Because the mastermind was likely foreign, using a translator or
18:21writing English as a second language. Most importantly, it explained something far more troubling,
18:26why the plan fell apart so catastrophically. The mastermind had apparently not accounted for Nancy's
18:31fragile health condition. Nancy had a pacemaker. Nancy required daily medications. Nancy's heart was
18:36failing. When porch guy took her from the home and moved her beyond the range of her cardiac
18:40monitoring device, Nancy's health deteriorated rapidly. A heart attack. Cardiac arrest. Simply
18:45the stress and shock of abduction combined with her existing condition could have been fatal.
18:50Suddenly the plan was no longer viable. They could not provide proof of life because there was no life
18:54to provide proof of. They could not collect ransom for a kidnapping victim who had died. The mastermind,
18:59remote and removed, faced a choice. Continue the charade or cut ties and flee. The second ransom
19:04note, according to this theory, was the mastermind's decision to exit the operation. We did not fully
19:09grasp the seriousness of her physical condition. We never intended to hurt her. That was not our
19:13intention. We are truly sorry. This was not an apology so much as a dismissal, a closing of
19:17communication. Then silence. No further demands. No further contact. The bitcoin wallet remained unused
19:23after the small test deposit. Porch guy, now holding the body of an elderly woman who had been the target
19:28of what was supposed to be a lucrative extortion operation, faced his own impossible situation. He could
19:33not turn to authorities without incriminating himself. He could not return the body without
19:37confirming his guilt. He had to dispose of remains somewhere in the vast Arizona desert and flee.
19:42The mastermind, potentially operating from thousands of miles away, from a country that might not have
19:47extradition treaties with the United States, might never face justice. Porch guy, unknown to the
19:52mastermind's identity, having been hired and paid through intermediaries, might be the only person on the
19:57ground who knew where Nancy was. If this theory was correct, it explained the investigative stagnation.
20:02It explained why nobody had been found despite intensive searches. It explained why the second
20:07note said buried in nature now, without coordinates or any subsequent negotiation. It explained the
20:12silence that followed. It explained why, despite possessing video footage of the abductor, DNA evidence,
20:18and an entire nation interested in solving the case, law enforcement remained stalled. It also
20:23explained the absence of information from official channels. If the FBI and Pima County Sheriff's
20:28Department suspected this pattern, they would be pursuing international investigations, working with
20:32foreign law enforcement, attempting to identify the mastermind through digital forensics and
20:36international cooperation. But these investigations move slowly. They require diplomatic channels. They
20:41require evidence that can survive cross-examination in court. Reporter Brianna Whitney, who had covered
20:47the case for Crime Junkie and reported from Tucson, offered her perspective. Based on everything we know,
20:52right? Like the way these are written and like how this has been carried out, this is possible. She noted
20:55that
20:56similar wrench attacks were on the rise globally, targeting digital assets and using cryptocurrency
21:00for untraceable payment. This seems to be on the rise like targeting digital assets. The mastermind
21:06could reopen communication and negotiate for payment in exchange for information about Nancy's location.
21:10DNA results could identify porch guy, leading to arrest and interrogation. Someone could come forward with
21:16identifying information. Or Nancy's remains could eventually be discovered by a hiker or explorer in the
21:21desert, years later, found by chance rather than investigation. None of these options provided
21:26immediate answers. All left the family in a state of prolonged anguish, searching for someone they
21:31might never find. The question that remained, six months into the investigation, was whether law enforcement
21:36had reached similar conclusions. Were they working secret international leads? Were they coordinating with
21:41foreign law enforcement? Or were they genuinely stalled with no clear path forward? Only the investigators knew,
21:47and they weren't talking. Thanks for watching. Check out other cards on the screen.
Comments