- The First Messages Seemed to Prove Someone Knew Too Much
- A $4 Million Demand Came with Two Chilling Words
- Then One Email Changed the Case from Kidnapping to Something Worse
- As Fake Ransom Demands Piled Up, Investigators Returned to the Original Notes
- The Man on Camera Did Not Seem to Match the Person Behind the Emails
- Instead of Paying the Ransom, the Task Force Tried a Tiny Test
- The Question That Still Haunts the Case: Did Caution Cost Them Their Best Chance?
- The Last Ordinary Evening
- The House Began Telling Its Own Story
- ‘She Didn’t Go Willingly’
- Blood at the Door, Bitcoin in the Message
- The First Public Plea
- The First Deadline Drew Near
- The ‘New Message’ Arrived
- The Search Moved from Hope to Terrain
- ‘An Hour of Desperation’
- A Face Without a Name
- The Man Who Said He Was Innocent
- The Backpack Trail
- DNA Promised an Answer, Then Held It Back
- The Family Was Cleared, and the Search Went Technical
- The Border Question
- Was the Suspect There Before?
- The Investigation Prepared for a Long Road
- The Glove Lead Fell Away
- Savannah Returned to ‘Today’ as the Story, Not the Anchor
- One Hundred Days Without an Answer
- The June Revelation That Reframed the Beginning
The case began in the early hours of February 1, 2026, when the 84-year-old mother and grandmother with a heart condition vanished from her Catalina Foothills home in Arizona…
For months, the disappearance of Nancy Guthrie has been wrapped in ransom notes, false leads, and one awful possibility after another. But now, the most haunting question may not be who took her — it may be whether investigators had their best chance in the first few days and let it slip away.
The First Messages Seemed to Prove Someone Knew Too Much
According to Air Mail’s report on the investigation, her disappearance soon became one of those chilling cases where the silence was almost immediately replaced by something worse: demands.
The first apparently credible emails arrived in early February and were sent to local television stations and TMZ. They reportedly described what Nancy had been wearing on the night she disappeared and accurately noted a damaged floodlight in the backyard of her home.
Those details mattered. They suggested the sender knew things that were not random, not guessed, and not easily dismissed as a cruel attempt to exploit a family’s terror. The first of these emails was reportedly sent at 6:42 p.m. on February 2, about a day after the abduction. In it, the sender claimed Nancy was “safe but scared.”
Nancy Guthrie’s disappearance began after what appeared to be an ordinary family evening in Tucson. Her case later shifted from a missing-person search into a suspected abduction marked by ransom messages, blood evidence, and unanswered questions. | Source: Facebook/Savannah Guthrie
A $4 Million Demand Came with Two Chilling Words
Then came the demand: The family was told to pay $4 million by 5 p.m. on February 5 to a specific Bitcoin wallet, after which Nancy’s return would allegedly be arranged. The sender also appeared to anticipate hesitation. If the family did not pay by February 9, the demand would rise to $6 million.
The message reportedly stressed that the terms were not negotiable. It ended with two words that still hang over the case: “Or else.” At that point, investigators seemed to have the ingredients of a possible trap. There was a ransom demand, a deadline, a Bitcoin wallet, and communication that appeared to carry signs of authenticity.
But the investigation took a darker turn later. On February 6, another email arrived, later known among investigators as the “bad” email.
Then One Email Changed the Case from Kidnapping to Something Worse
That message reportedly came from the same IP address as the earlier, seemingly credible emails. But instead of repeating the original demand with confidence, it allegedly opened with what one source close to the case described as a sputtering “apology” for Nancy’s inadvertent death.
From there, the message reportedly offered a grim new transaction: Nancy’s body could be delivered for money, though it was apparently unclear whether the amount was still the original $4 million or some other sum.
Before her disappearance, Nancy was known to her family as a resilient woman whose life and faith became central to Savannah Guthrie’s public pleas. As the case stretched on, those personal details made the mystery feel even more painful than the headlines could capture. | Facebook/nancy.guthrie.31
With that, the case changed shape. What had been treated as a kidnapping suddenly became a potential homicide investigation as well. The next day, Savannah Guthrie appeared in a 20-second Instagram video with her siblings, Camron and Annie. Sitting beside them, she spoke directly to the person believed to be behind the messages.
“We received your message and understand,” Savannah said. “We beg you now to return our mother to us, so that we can celebrate with her…. This is very valuable to us, and we will pay.”
Savannah Guthrie’s February 7 video later took on a darker meaning after reports said a second message had already claimed Nancy Guthrie was dead. Her carefully worded plea may have been aimed at someone the family believed could still return their mother. | Source: Instagram/savannahguthrie
To anyone watching without context, the wording may have sounded cryptic. But viewed against the alleged offer to exchange Nancy’s remains for money, it becomes heartbreakingly clear.
As Fake Ransom Demands Piled Up, Investigators Returned to the Original Notes
Inside the investigation, the ransom communications were reportedly divided into three categories: “the good, the bad, and the ugly.” The “good” messages were the early emails that appeared to contain credible details, while the “bad” email was the one that claimed Nancy had died.
Then there were the “ugly” communications. These were the alleged copycat demands from people who, according to investigators, did not appear to know where Nancy was but still tried to profit from the horror surrounding her disappearance.
The clip became one of the most haunting public moments in the case because Savannah said the family had “received” and “understood” the message. In hindsight, those words may have referred not to a demand for Nancy’s release, but to a grim offer involving her return. | Source: Instagram/savannahguthrie
According to the unofficial estimate shared with Air Mail, more than a dozen of these contrived notes have been received. Their arrival added another cruel layer to an already brutal case.
One alleged offender, Derrick Callella, was accused of sending a fraudulent ransom text message from an internet-based phone line to Nancy’s daughter Annie and her husband, Tommaso. The message allegedly demanded an unspecified amount of Bitcoin.
A follow-up text reportedly read, “Did you get the bitcoin were [sic] waiting on our end for the transaction.” Derrick’s trial was scheduled to begin later that month in Tucson.
The so-called “ugly” category reportedly gained another entry in April, when TMZ received a new series of emails. The sender first claimed to have seen Nancy in Sonora, Mexico, then later claimed she was dead.
For half a Bitcoin, about $34,000, the sender allegedly offered to reveal both the location of Nancy’s body and the identity of the kidnapper. At first, investigators reportedly felt a rush of hope because the format resembled the initial ransom notes.
But that hope did not last. The task force later concluded the sender was likely not a breakthrough witness, but a malicious con artist.
With leads failing and suspects reportedly taken into custody only to be released and exonerated, the Special Task Force returned again and again to the notes. The team, made up of FBI agents and homicide detectives from the Pima County sheriff’s department, began treating every sentence as potentially important.
The theory was simple and desperate: if the kidnapper had left a clue anywhere, it might be hidden in the language. Investigators reportedly decided that nothing was too small to examine anymore.
The psychological side of the investigation focused on the apparently genuine notes. Working with FBI forensic psychologists, investigators studied the language to build a profile of the person who wrote them.
The writer appeared educated, articulate, and familiar with the mechanics of cryptocurrency. That profile did not neatly match the early speculation that a coldhearted cartel member might have been behind the crime.
The “apology” in the email claiming Nancy had died suggested something else. Investigators reportedly began to consider that the writer may have been someone who had gotten in over their head.
Their working theory became that the abductor was likely an opportunist: ruthless, educated, and possibly local. This person may have seen a chance for a massive payday, only for the plan to collapse when Nancy died, either through violence or illness.
Savannah Guthrie later spoke about her mother’s strength, faith, and personality in an emotional “Today” interview with Hoda Kotb. The conversation showed how Nancy’s disappearance had become not only a national story, but a deeply personal crisis for the family at its center. | Source: Instagram/savannahguthrie
The Man on Camera Did Not Seem to Match the Person Behind the Emails
But one piece of evidence complicated that profile: Ring-camera footage reportedly showed a ski-masked man outside Nancy’s home with a revolver tucked into a waist holster.
The man appeared both threatening and strangely clumsy. At one point, he allegedly tried to block the camera lens with a handful of weeds, a detail that made him look less like a polished criminal mastermind and more like someone improvising badly.
That contrast pushed investigators toward another possibility: The kidnapping may have involved more than one person, with one supplying the physical force and another handling the written demands and cryptocurrency knowledge.
While the psychological work continued, investigators also re-canvassed the digital crime scene. Because the ransom emails had been sent to the “Submit a tip” web addresses of several media companies, cyber specialists probed the hosting servers.
The crypto squad reportedly identified IP addresses and routing data connected to the incoming messages. They also monitored the Bitcoin wallet shared in the initial notes. On paper, cryptocurrency can look like a clever way to receive money without being traced. But the FBI’s specialists knew the anonymity could break down once the money moved.
Instead of Paying the Ransom, the Task Force Tried a Tiny Test
The key was what cyber investigators call “off-ramp tracking.” In simpler terms, they hoped to watch what happened when the kidnapper tried to convert Bitcoin into spendable cash.
That was the trap. If the ransom was paid and the kidnapper tried to cash out, investigators believed they might be able to follow the money into a real-world bank account.
Even if the kidnapper used a chain of proxy servers to hide their location, the bureau reportedly believed it could crack through the digital maze. The old investigative rule still applied: follow the money.
But instead of having the Guthrie family pay the full $4 million demand, the task force tried a cheaper test. They decided to “tickle the wire,” bureau-speak for making a payment into the wallet to see whether anyone reacted. The amount was stunningly small compared with the original demand. Investigators reportedly deposited just $152, or about 0.22 percent of a single Bitcoin.
Then they waited. And nothing happened. The $152 remained untouched in the wallet. The kidnapper did not move it, did not cash out, and did not give investigators the trail they had hoped for.
Maybe the amount was too tiny to tempt anyone. Maybe the kidnapper sensed a trap. Or maybe, by then, whoever was behind the messages had already lost interest, lost control, or disappeared into the shadows.
The digital team reportedly called the result “crypto dormancy.” In practice, that meant the money went still, and so did the promising trail investigators had been counting on.
The IP addresses, the Bitcoin wallet, the routing data, and the psychological profile all failed to identify a specific suspect. After all the scrutiny, the notes had not brought investigators closer to the culprits or to Nancy.
The Tucson Police Department, the task force, and the district attorney’s investigative squad reportedly did not respond to multiple requests for comment. That silence leaves the reported internal frustration sounding even louder.
Nancy Guthrie’s disappearance has been shadowed by disturbing notes that appeared to shift the case from a possible ransom demand to a far darker mystery. A veteran investigator now believes the lack of a credible demand may be one of the most telling details. | Source: Getty Images
The Question That Still Haunts the Case: Did Caution Cost Them Their Best Chance?
And that is where the most dramatic theory in the investigation enters the story. These days, according to Air Mail, some on the task force believe a colossal — perhaps even “literally fatal” — mistake was made early in the case.
They call it “the Big Jake Theory.” The name comes from the 1971 John Wayne film “Big Jake,” part of which was filmed in Arizona, about 400 miles north of Nancy’s home. In the movie, Big Jake’s grandson is kidnapped, and a $1 million ransom demand is made. Jake is ready to deliver the money, but with a plan: get the child back and make sure the kidnappers do not keep the cash.
As Nancy’s family and community continue waiting for answers, Barbara Butcher’s theory has added a grim new possibility to the case. The longtime investigator suggested the person responsible may have acted on a reckless assumption about Nancy’s family and money. | Source: Getty Images
A Pima County detective assigned to the task force reportedly argued that this is the scenario investigators should have followed in Nancy’s case. Once the $4 million demand arrived and the sender’s credibility appeared to be established, the money should have been deposited into the designated crypto wallet.
The logic is brutally simple: Paying the ransom could have created a chance to get Nancy back, possibly even alive. Then, if the culprits tried to convert the Bitcoin into cash, investigators could have used off-ramp tracking to identify them. In theory, the kidnappers would be caught, and the money could be returned to the family.
Instead, the task force tried the $152 test, and it did not lure anyone out. That is the uncomfortable shadow now hanging over the case: Investigators had a wallet, a demand, and a sender who appeared to know real details from the abduction, but the response they tested was a tiny fraction of what had been demanded.
Of course, there is no guarantee the full payment would have saved Nancy Guthrie or exposed the culprit. Real life rarely works as neatly as a John Wayne movie. But that is exactly what makes the reported regret so painful. The task force may never know whether the bigger move would have changed everything.
The Last Ordinary Evening
As previously reported:
To understand how deeply the ransom messages have fractured the case, it helps to go back to the last ordinary night anyone can place Nancy in the timeline. She was last seen on Saturday night, January 31. She arrived at her daughter Annie’s home at 5:32 p.m. She had dinner there, surrounded by the familiar rhythms of family.
Later that night, she was dropped off at her own home in Tucson, Arizona, at around 9:48 p.m. Her son-in-law, Tommaso Cioni, waited until Nancy was safely inside before driving away.
At 9:50 p.m., her garage door closed. That detail, small and precise, became one of the last markers of Nancy’s known life before the mystery began. The garage door closed; Nancy was believed to be home; the night should have ended there. But sometime after that, the trail began to twist…
The House Began Telling Its Own Story
In the early hours of February 1, the first strange signs appeared. Nancy’s doorbell camera disconnected at 1:47 a.m. Around 25 minutes later, software detected someone — or possibly an animal — on a camera. Then, at 2:28 a.m., Nancy’s pacemaker app disconnected from her phone.
Each detail, taken alone, might have left room for uncertainty. Together, they formed a troubling pattern. By Sunday morning, Nancy had not appeared at church. For those who knew her routine, that absence was enough to raise alarm.
A friend contacted Nancy’s family. They checked on her and then notified the sheriff’s department around noon.
Nancy Guthrie’s Tucson home became the center of an urgent investigation after authorities said she appeared to have been abducted from the residence. What began as a search for a missing mother later expanded into a case involving ransom messages, FBI resources, and a growing list of clues. | Source: Getty Images
Police arrived at Nancy’s home at 12:15 p.m. and determined that she was missing under “concerning” circumstances.
The concern was immediate. The 84-year-old had limited mobility and relied on daily medication. This was not a woman who could easily disappear into the world without help. The house, the disconnected technology, and her absence from church all seemed to be saying the same thing: Something was wrong.
‘She Didn’t Go Willingly’
On February 2, Pima County Sheriff Chris Nanos publicly confirmed that Nancy’s disappearance was being treated as a crime. He urged neighbors to check home surveillance footage. Investigators had found things at Nancy’s home that concerned them. Then Nanos said the words that sharpened the entire investigation:
“She didn’t walk from there. She didn’t go willingly.”
That statement changed the emotional temperature of the search. Nancy was no longer simply missing; she had been “abducted.” Authorities believed someone had taken her. The quiet Tucson home was now a crime scene, and the woman at the center of it was in danger. A missing person’s flier, describing Nancy as five feet, five inches tall, with brown hair and blue eyes and weighing 150 pounds, was released.
Blood at the Door, Bitcoin in the Message
By February 3, the clues had become more alarming. Authorities said they were analyzing an apparent ransom note that included details about what Nancy had been wearing on the night of the crime. The note demanded payment in Bitcoin. At the same time, investigators were looking at what appeared to be drops of blood outside the front door.
A law enforcement source shared that blood was also found inside the house. The blood outside the home was later confirmed to be Nancy’s. That detail took away some of the case’s remaining softness. This was not only a disappearance; it may have involved violence, or at least injury, near the threshold of Nancy’s own home.
Still, there was no suspect. Surveillance video had not yet given investigators the answer they needed. Sheriff Nanos said nothing had come up that clearly identified “your bad guy.” The case had evidence; it had fear; it had urgency. But it did not yet have the face of a suspect.
The First Deadline Drew Near
On February 5, the ransom demand reached its first critical moment. Sheriff Nanos said at a news conference that authorities believed Nancy was “still out there.” FBI Special Agent Heith Janke confirmed that the note included a 5 p.m. deadline. He said that if a transfer was not made, there appeared to be a second demand for the following Monday.
He would not say what the note claimed would happen if the demands were ignored. That omission made the silence more frightening. The FBI announced a $50,000 reward for information leading to Nancy’s recovery or to the arrest and conviction of those involved. Authorities kept asking for tips. They said it could take just one piece of information to break the case open.
That evening, Camron made another plea for contact. He said the family had not heard directly and needed a way to communicate. It was a family trying to open a line to the person who had taken their mother. But the next day, a message came…and it was not the kind anyone had prayed for.
The ‘New Message’ Arrived
On February 6, CBS News’ Tucson affiliate, KOLD, received a second message. However, the station did not release details, citing respect for the family and the investigation. Publicly, authorities said they were aware of a “new message” and were checking its authenticity. The Pima County Sheriff’s Department said investigators were actively inspecting the information.
The FBI issued a similar statement. To the public, it was another vague update in a frightening case. But the newer reporting gives that moment a very different meaning. This was reportedly the message that contained the rambling “apology” for Nancy’s inadvertent death.
It was the message that may have turned the investigation from a kidnapping into a potential homicide, and it was the message Savannah appeared to answer the very next day.
As the search stretched on, federal investigators combed areas around Nancy’s home for physical clues that could move the case forward. The investigation increasingly depended on small traces — from DNA to surveillance footage — that might connect the masked subject to the scene. | Source: Getty Images
The Search Moved from Hope to Terrain
After the second message, the investigation seemed to close in again on physical spaces. On February 7, a few hours after Savannah’s video, investigators went to Annie’s home. That was the home where Nancy had eaten dinner the night before she vanished. They stayed for about two and a half hours and focused mostly on the garage.
Two law enforcement sources said that investigators were “developing good information,” though “nothing is imminent.” The phrase was maddening. It suggested movement, but not resolution.
On February 8, detectives were back at Nancy’s home. They focused on the backyard perimeter and searched what appeared to be a septic tank. It was the kind of search detail that tells readers what officials could not yet say. Investigators were no longer only looking for a person; they were looking for traces.
‘An Hour of Desperation’
By February 9, the search had entered its second week. A second ransom deadline was looming. Investigators were canvassing nearby gas stations, looking for suspicious vehicles caught on surveillance cameras around the time Nancy vanished. A sheriff’s deputy was placed outside Nancy’s home around the clock.
The case was now both a crime investigation and a protected scene. That afternoon, Savannah asked the public for help again. She said the family was at “an hour of desperation.” She told people that law enforcement was working tirelessly to bring Nancy home and asked anyone, even far from Tucson, to report anything strange.
A Face Without a Name
On February 10, authorities finally released images and video of a subject in Nancy’s disappearance. The figure was masked, gloved, and carrying a backpack.
The footage had been recovered from Nancy’s home security camera system after initially being inaccessible. One video showed the individual approaching the front door and raising a gloved hand toward the camera. Another showed the person holding a flashlight in their mouth before covering the camera lens with vegetation. The person appeared to be armed.
For the first time, the public could see a figure connected to the mystery. But seeing someone was not the same as knowing who he was. Savannah responded to the images by writing: “We believe she is still alive. Bring her home.”
Hours later, a subject was detained during a traffic stop south of Tucson and questioned in connection with the case. It looked, briefly, like the investigation might have found its way to a person. But the story did not settle there…
The Man Who Said He Was Innocent
On February 11, a man who said he had been questioned as a person of interest spoke to reporters after being released. He identified himself only as Carlos, and said he did not know Nancy.
“I didn’t do anything. … I’m innocent,” he stated. Authorities did not confirm that Carlos was the person of interest or that the person of interest had been released. A woman in Rio Rico, Josefina Maddox, also spoke outside a home authorities were searching.
She said her son-in-law had “nothing to do with it.” She added that authorities were “just invading my property” and insisted, “we’re not hiding anything.” The public had seen a possible suspect image, heard about a detention, and then watched certainty dissolve again. The mystery remained open.
The Backpack Trail
On February 12, the FBI released the first physical description of the suspect. He was described as a male of average build, approximately 5-foot-9 or 5-foot-10. The black 25-liter Ozark Trail Hiker Pack backpack seen in the doorbell footage became an important clue. The FBI doubled its reward to $100,000 for information leading to Nancy’s location or to an arrest and conviction.
Around that time, investigators were also examining black gloves found during the search. The gloves appeared to resemble those worn by the figure in the video.
For investigators, the case seemed to move through objects: a backpack, gloves, a mask, a camera, a door, a pacemaker signal. Each object carried the possibility of a name. But each one still had to prove it belonged to the story.
The black Ozark Trail Hiker Pack became one of the most closely watched clues after the FBI said a similar backpack appeared in doorbell footage from Nancy’s home. Investigators later reviewed purchase records and surveillance connected to the item as they tried to identify the masked subject. | Source: X/@fbiphoenix
DNA Promised an Answer, Then Held It Back
On February 15, the FBI said a black glove found near Nancy’s home contained DNA evidence. The glove appeared to match those worn by the subject in the surveillance footage. The agency was waiting for confirmation before submitting an unknown male profile to CoDIS, the national DNA database. It sounded like the kind of clue that could crack a case.
A glove; DNA; a possible match to the video. But two days later, the hope dimmed. On February 17, authorities said the unknown male DNA profile did not return a match from the national database.
Additional DNA evidence found at Nancy’s home was still being analyzed. The trail had not ended, but it had not delivered the answer either.
The Family Was Cleared, and the Search Went Technical
On February 16, Sheriff Nanos publicly cleared all members of the Guthrie family and their spouses as suspects. He said they had been cooperative and gracious. He also said suggesting otherwise was cruel. That mattered.
High-profile cases often invite ugly speculation, and the sheriff’s statement drew a clear line around the family: They were not suspects; they were victims.
Meanwhile, investigators were looking closely at what the suspect wore. They believed the clothing and mask seen in the security video may have been purchased at Walmart, either in person or online.
Additionally, the Ozark Trail backpack was sold exclusively at Walmart. Sheriff Nanos called the backpack “one of the most promising leads” in the case. Investigators reviewed surveillance footage from local Walmart locations, and the company provided records of Ozark Trail Hiker purchases from recent months. They also deployed a high-tech tool called a “signal sniffer.”
