Investigators are examining ransom letters tied to the disappearance of 84-year-old Nancy Guthrie that were sent to media outlets rather than her family, including one to TMZ stating she is “safe but scared” and aware of the demands, authorities and media executives said Friday. Guthrie, the mother of “Today” co-host Savannah Guthrie, was reported missing after relatives could not reach her late last weekend.
Law enforcement officials said the communications are part of an active investigation coordinated by the Pima County Sheriff’s Department and the FBI. One letter demanded a multimillion-dollar bitcoin payment and included a deadline; a subsequent message surfaced later in the week and was forwarded to authorities for analysis. Detectives returned to Guthrie’s neighborhood to re-canvas the area and reprocess her home while specialists worked to verify the source and credibility of the messages. Family members issued emotional appeals for contact and proof of life as the first deadline passed without publicly confirmed follow-up. The case has drawn national attention because the messages went to newsrooms and because Guthrie has health conditions that require daily medication.
TMZ founder Harvey Levin said his newsroom received a letter that laid out specific instructions and timelines. He described the communication as “structured” and said it asserted that Guthrie was alive, frightened and in the custody of abductors. Local officials did not release the full text, citing the ongoing inquiry, but confirmed they were reviewing the note and subsequent correspondence that arrived at another Arizona outlet. The sheriff’s office said investigators are tracing how and from where the messages were sent, including any internet services used to mask locations. Detectives also asked nearby residents for home-security footage and interviewed neighbors who might have seen unusual activity around the time Guthrie was last seen. “We are following every credible lead,” a department spokesperson said.
Authorities said the initial letter sought payment in bitcoin and included a threat of consequences if the deadline was missed. A later message was received by a local television station and relayed to federal agents. Officials said the second communication appeared to originate from a different technical path but contained elements that could connect it to the first. Investigators emphasized that determining authenticity is crucial, noting that it is unknown whether the author or authors have actual control over Guthrie. As part of standard protocol, agents are analyzing metadata, checking blockchain details tied to any wallet addresses listed and comparing phrasing and timing across the messages. Detectives have not announced a suspect and did not disclose who first noticed Guthrie was missing or the exact time of her last verified contact.
Guthrie’s home in suburban Tucson remained a focal point for evidence collection. Deputies documented the exterior, processed the porch and doorway and searched the property with consent and warrants obtained as needed. Officials have said publicly that physical traces were found at the residence during the initial response; they declined to describe specific items in detail while laboratory testing proceeds. Family members told reporters that Guthrie requires daily medication and that the absence of routine check-ins raised alarms. Sheriff’s investigators asked residents to report any sightings of unfamiliar vehicles or late-night activity in the area around the time she vanished.
The disappearance gained momentum nationally after television segments highlighted the letters and their unusual route to media instead of direct contact with loved ones. A former federal agent interviewed on cable news said the pattern diverges from “traditional” kidnap-for-ransom cases, where communication is typically directed at the family to maintain leverage. He cautioned that high public attention can complicate negotiations and evidence collection. At the same time, national officials have publicly expressed confidence that the investigation has advanced since the first letter was disclosed. During separate remarks, President Donald Trump said federal authorities had developed “very strong” clues and suggested an update could come as agencies compare digital evidence and field reports.
Neighbors described a steady law-enforcement presence on Guthrie’s street as the week progressed, with cruisers idling near intersections and plainclothes detectives canvassing door-to-door. Residents said they were asked about doorbell cameras, overnight deliveries and visitors to the block. Crime-scene tape briefly restricted access as technicians photographed the property in daylight and at night. A nearby shop owner said patrols increased along the corridor, and deputies asked businesses to keep an eye out for anyone attempting to sell or swap electronics—an inquiry consistent with efforts to locate devices that could contain relevant data.
Investigators said verifying the letters includes several tracks: technical forensics to identify routing and devices; language analysis to compare style and key phrases; and financial reviews of any cryptocurrency addresses, including whether funds move or whether the addresses are decoys. Agents also examine whether the messages include details not publicly known that would demonstrate access to Guthrie or her surroundings. The FBI and sheriff’s department have not disclosed whether the letters contained such nonpublic markers. Officials reiterated that public release of certain specifics could tip off the sender and impede the search.
The sequence began over the weekend when relatives could not reach Guthrie and contacted authorities. Deputies conducted welfare checks and alerted nearby agencies to be on the lookout. By early week, a letter had arrived at TMZ outlining a bitcoin demand and timeline. As the first deadline approached, family representatives called for confirmation that Guthrie was alive and pleaded for direct contact. After the deadline passed, another message surfaced at a local station, and investigators widened their review. As of Friday evening, there was no official confirmation that any funds were transferred or that the sender responded to the appeals.
Public records show the neighborhood includes single-story homes on cul-de-sacs off a main thoroughfare. The area has a mix of longtime residents and seasonal visitors, and neighbors said daytime foot traffic is light, with most activity centered on morning and evening hours. Several residents described routine delivery routes and dog-walking patterns that investigators asked about during interviews. Patrol cars made repeated passes while technicians logged camera angles from houses with doorbell devices, including those facing side yards and alleys. A mobile command post was staged nearby during portions of the week as detectives cross-checked tips arriving by phone and online.
Under federal and state procedure, authorities compile a case file that includes call logs, canvass notes, forensic submissions and any digital evidence from the letters. If investigators identify a suspect or location, they can seek court orders for additional records or rapid-response warrants. In a kidnap-for-ransom probe, agents typically coordinate with prosecutors early to ensure any recovery efforts do not undermine potential charges such as kidnapping, extortion or wire fraud. Officials did not announce any planned briefings but said updates would be provided as soon as they could release verified information without jeopardizing the search.
As of Friday night, Guthrie’s whereabouts remained unknown. The family continued to request privacy while cooperating with investigators, and officials said any additional messages connected to the case would be routed immediately to the FBI for evaluation. Detectives planned to maintain increased patrols in the neighborhood and keep forensic teams on standby through the weekend as lab results and digital analyses come in.
Author note: Last updated February 7, 2026.