The ongoing investigation into the disappearance of Nancy Guthrie, mother of “Today” show co-host Savannah Guthrie, has taken a dramatic turn with the discovery of a ransom note demanding payment in bitcoin. The note, which is being seriously considered by law enforcement, set a deadline of 5 p.m. Thursday for the ransom, although it did not specify a time zone. If the payment was not made by that time, a subsequent deadline was set for Monday.
The choice to demand payment in bitcoin raises significant questions regarding the nature of cryptocurrency, particularly its capacity to obscure the identity of criminals. However, experts suggest that the semi-anonymous nature of bitcoin may not be as protective as the kidnappers might hope. According to analysts from CBS News, law enforcement has methods to track individuals or organizations involved in cryptocurrency transactions, which could lead to potential breakthroughs in the Guthrie case.
Bitcoin transactions are recorded on a public blockchain, much like a comprehensive bank ledger. To initiate a transaction, users need a bitcoin wallet containing an alphanumeric address, which allows for the storage of both private keys (for authorizing transfers) and public keys (for receiving funds). This addresses and transaction data can serve as crucial starting points for investigators trying to track criminals. Ari Redbord, a former Department of Justice and Treasury official who now leads policy at TRM Labs, emphasizes that every bitcoin transaction is logged on an immutable public ledger, meaning that the transaction history is permanently accessible. Investigators can trace all transactions to and from a specific wallet address, potentially identifying the wallet’s owner.
Contrary to common belief, cryptocurrency is not entirely untraceable. Analyses can reveal if a wallet has been involved in illicit activities or whether it is linked to ransomware or other cybercrimes. By examining which other bitcoin addresses send funds to the wallet in question, investigators can build a comprehensive profile that aids in identifying the perpetrator. Madeleine Kennedy, vice president of communications at Chainalysis, points out that law enforcement often prefers tracking cryptocurrency transactions over traditional ransom payments made in art, diamonds, or cash.
Once a bitcoin wallet owner attempts to cash out through a cryptocurrency exchange, law enforcement’s information-gathering capabilities broaden significantly. In the U.S., exchanges like Coinbase and Binance must adhere to “know your customer” regulations aimed at anti-money laundering. These regulations require exchanges to collect extensive personal information, including a customer’s legal name, birth date, home address, and often, government-issued identification.
If investigators need more information, they can issue subpoenas to cryptocurrency exchanges to obtain data on users associated with particular wallet addresses. Redbord explains that law enforcement can capture crucial details such as names, birthdays, Social Security numbers, and even email addresses when users seek to convert crypto assets into fiat currency.
However, the investigation faces time constraints. Experts note that the speed at which criminals can maneuver funds through exchanges complicates the tracking process. If the funds are transferred to an unregulated exchange that does not follow customer identification rules, the chances of retrieval diminish significantly. “The challenge is that bad actors can move faster than ever, and it really becomes this race to the off-ramps in cases like this,” Redbord adds.
As investigators continue their search for Nancy Guthrie, the emerging complexity surrounding cryptocurrency transactions could either offer crucial leads or challenge law enforcement’s response times in this alarming case.

